CVE-2025-14147 is a stored cross-site scripting vulnerability in the Easy GitHub Gist Shortcodes WordPress plugin (versions up to 1.0). The vulnerability exists because the plugin does not properly sanitize or escape the 'id' parameter of the gist shortcode, allowing authenticated users with Contributor-level permissions or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 score is 6.4 (medium), with attack vector network, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts confidentiality and integrity with no availability impact.

An attacker with Contributor-level access can inject persistent malicious scripts into pages via the 'id' parameter of the gist shortcode. When other users visit these pages, the injected scripts execute in their browsers, potentially compromising user data confidentiality and integrity. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Easy GitHub Gist Shortcodes plugin if possible to prevent exploitation.