CVE-2025-14835 is a reflected XSS vulnerability in the WP Photo Album Plus plugin for WordPress affecting all versions up to 9.1.05.008. The issue stems from improper neutralization of script-related HTML tags in the 'shortcode' parameter, enabling attackers to inject malicious scripts that execute when a user interacts with a crafted link. The vulnerability requires no privileges but does require user interaction. It is classified under CWE-80 and has a CVSS 3.1 base score of 7.1, indicating high severity.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser session. This may allow attackers to steal session tokens, perform actions on behalf of the user, or deliver malicious payloads. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector (C:L/I:L/A:L). There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the vulnerable shortcode parameter or applying custom input sanitization and output escaping as a temporary mitigation. Monitor the vendor's communications for updates on patches or official fixes.