CVE-2025-14554 is a stored cross-site scripting vulnerability in the Sell BTC – Cryptocurrency Selling Calculator WordPress plugin. It arises from improper neutralization of input during web page generation, specifically via the 'orderform_data' AJAX action. This allows unauthenticated attackers to inject arbitrary scripts into order records, which execute in the context of the administrator's browser when accessing the Orders page. The vulnerability affects all versions up to and including 1.5, with a partial patch applied in version 1.5. No complete patch or remediation details are currently provided.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the administrator's browser context, potentially leading to credential theft, session hijacking, or other administrative actions performed unknowingly by the administrator. The impact is limited to the administrative interface and does not affect availability. The CVSS 3.1 score of 7.2 reflects high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and partial impact on confidentiality and integrity.

No official or complete patch is currently available as per the provided data. The vulnerability was partially patched in version 1.5, but users should verify with the vendor for any updated fixes or advisories. Until a full patch is released, administrators should limit access to the Orders page to trusted users only and consider monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.