CVE-2025-14785 is a stored cross-site scripting vulnerability in the Website Builder by SeedProd plugin for WordPress, specifically affecting the seedprodnestedmenuwidget shortcode. Due to improper neutralization of input during web page generation, authenticated attackers with contributor or higher privileges can inject arbitrary scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 6.20.2. No official patch or remediation level has been confirmed in the provided data.

The vulnerability allows authenticated users with contributor-level access or higher to inject malicious JavaScript code into pages generated by the plugin. This code executes in the browsers of users who visit the compromised pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions within the context of the affected site. The CVSS score of 6.4 reflects a medium impact with low attack complexity and no user interaction required beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the seedprodnestedmenuwidget shortcode if possible. Monitor official SeedProd communications for updates regarding patches or mitigations.