CVE-2025-14436 is a stored cross-site scripting vulnerability in the Brevo for WooCommerce plugin for WordPress, affecting all versions up to 4.0.49. The issue arises from improper neutralization of input in the 'user_connection_id' parameter, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute when users access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity. No patch or official fix has been documented in the provided data.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of users visiting the affected pages, potentially compromising user sessions and data confidentiality. The vulnerability does not impact availability and requires no privileges or user interaction to exploit. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin component or applying manual input sanitization if feasible. Monitor vendor channels for updates and apply patches promptly once released.