CVE-2025-14278 is a stored cross-site scripting vulnerability in the HT Slider for Elementor WordPress plugin affecting all versions up to 1.7.4. The flaw exists due to improper neutralization of input in the 'slide_title' parameter, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary JavaScript code. This code executes in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 6.4 (medium severity).

Successful exploitation allows an authenticated user with Contributor or higher privileges to inject persistent malicious scripts into pages using the HT Slider plugin. These scripts execute in the browsers of users who view the affected pages, potentially leading to information disclosure or user session compromise. There is no indication of impact on system availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level and higher access to trusted users only. Monitor for plugin updates from htplugins and apply any official patches promptly once released.