CVE-2025-14378 is a stored cross-site scripting vulnerability in the themeregion Quick Testimonials WordPress plugin (up to version 2.1). It arises from improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of admin settings input. Authenticated attackers with administrator privileges can inject arbitrary scripts that execute in the context of users visiting the injected pages. The vulnerability affects multisite WordPress setups and installations where unfiltered_html is disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges.

An attacker with administrator-level permissions can inject malicious scripts into pages generated by the Quick Testimonials plugin, leading to stored cross-site scripting. This can result in limited confidentiality and integrity impacts, such as session hijacking or content manipulation, but does not affect availability. The vulnerability is constrained to multisite installations or those with unfiltered_html disabled, limiting its scope. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the Quick Testimonials plugin in multisite environments or where unfiltered_html is disabled. Monitor vendor communications for updates on patches or official mitigations.