CVE-2025-7501 is a stored cross-site scripting vulnerability (CWE-79) in the Wonder Slider Lite WordPress plugin. The flaw exists due to insufficient input sanitization and output escaping of image title and description fields, enabling authenticated users with Contributor or higher privileges to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 14.4. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via image titles and descriptions. These scripts execute in the browsers of users who visit the affected pages, potentially compromising user sessions or performing unauthorized actions within the context of the victim's privileges. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. In the meantime, limit Contributor-level access to trusted users only and consider removing or disabling the Wonder Slider Lite plugin if feasible. Applying web application firewall (WAF) rules to detect and block suspicious script injections may provide temporary mitigation.