CVE-2025-14797 is a stored cross-site scripting vulnerability in the Same Category Posts WordPress plugin (versions up to 1.1.19). The issue arises from the plugin's use of htmlspecialchars_decode() on taxonomy term names before output, which negates WordPress's default HTML entity encoding designed to prevent XSS. This flaw allows authenticated users with Author-level or higher privileges to inject arbitrary JavaScript into widget titles, which executes in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity), with network attack vector, low attack complexity, privileges required at the Author level, and requiring user interaction. No vendor patch or advisory is currently available, and no known exploits have been reported.

An attacker with Author-level or higher privileges can inject malicious scripts into widget titles via taxonomy term names, leading to stored cross-site scripting. This can result in the execution of arbitrary JavaScript in the browsers of users who view the affected pages, potentially compromising user sessions or performing actions on behalf of users. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires authenticated access and user interaction to trigger.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level user privileges to trusted users only and consider disabling or removing the Same Category Posts plugin if possible. Monitor for updates from the plugin vendor or WordPress security sources for an official patch or mitigation.