CVE-2025-14792 is a stored XSS vulnerability in the Key Figures plugin for WordPress, affecting all versions up to and including 1.1. The vulnerability arises from insufficient input sanitization and output escaping in the kf_field_figure_default_color_render function. Exploitation requires administrator-level privileges on multisite WordPress installations or sites where the unfiltered_html capability is disabled. The vulnerability allows injection of arbitrary web scripts that execute in the context of users viewing the compromised pages.

Successful exploitation can lead to the execution of arbitrary scripts in the browsers of users who visit the injected pages, potentially enabling session hijacking, defacement, or other script-based attacks. The impact is limited by the requirement for administrator-level access and specific WordPress configurations (multisite or unfiltered_html disabled). There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the Key Figures plugin on multisite installations or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once released.