CVE-2025-14735 is a stored cross-site scripting vulnerability (CWE-80) in the nestornoe Amazon affiliate lite Plugin for WordPress. It affects all versions up to and including 1.0.0. The vulnerability exists due to improper neutralization of script-related HTML tags in admin settings, allowing authenticated administrators to inject arbitrary scripts. This vulnerability is limited to multi-site WordPress installations or those with unfiltered_html disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction.

An authenticated attacker with administrator-level permissions can inject malicious scripts into pages via the plugin's admin settings. These scripts execute when users access the affected pages, potentially leading to unauthorized actions or data exposure within the context of the affected site. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires high privileges and affects multi-site or restricted HTML capability installations.

No official patch or fix is currently available for this vulnerability. Administrators should monitor the vendor's advisory for updates. Until a fix is released, limit administrator access to trusted users only and consider disabling or replacing the plugin in multi-site environments or where unfiltered_html is disabled. Review and sanitize admin inputs carefully to reduce injection risks.