CVE-2025-14445 is a stored cross-site scripting vulnerability in the Image Hotspot by DevVN WordPress plugin affecting all versions up to 1.2.9. The issue stems from improper neutralization of input in the 'hotspot_content' custom field meta, allowing authenticated users with author-level access or higher to inject arbitrary web scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to data theft or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4 with network attack vector, low attack complexity, privileges required at the author level, no user interaction needed, and impacts confidentiality and integrity with no availability impact.

An attacker with author-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to unauthorized disclosure of information and modification of data within the context of the vulnerable site. There is no indication of availability impact or known active exploitation. The medium CVSS score reflects moderate risk due to the required privileges and potential impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and consider removing or sanitizing the 'hotspot_content' custom field inputs manually. Monitor for updates from the plugin vendor or WordPress security channels for an official patch or mitigation instructions.