CVE-2025-10139

MEDIUM

2025-10-15 [email protected]

WordPress XSS

6.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 17:22 vuln.today

CVE Published

Oct 15, 2025 - 09:15 nvd

MEDIUM 6.4

DescriptionNVD

The WP BookWidgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bw_link' shortcode in all versions up to, and including, 0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in WP BookWidgets plugin for WordPress allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts via the 'bw_link' shortcode due to insufficient input sanitization and output escaping. When a user visits a page containing the injected shortcode, the malicious script executes in their browser context. This vulnerability affects all versions up to and including 0.9. No public exploit code or active exploitation in the wild has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability exists in the WP BookWidgets WordPress plugin (CVE-2025-10139), specifically within the 'bw_link' shortcode handler. The root cause is improper handling of shortcode attributes-the plugin fails to sanitize user-supplied input attributes and does not properly escape output when rendering the shortcode, allowing attackers to inject malicious JavaScript code that persists in the WordPress database and executes when pages are accessed. This is a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation). The attack vector is network-based over HTTP/HTTPS, and while the vulnerability requires authenticated access at the WordPress contributor role level or higher, it bypasses the need for user interaction (UI:N per CVSS) and impacts confidentiality and integrity across site boundaries (Scope:Changed).

Affected ProductsAI

The WP BookWidgets WordPress plugin in all versions up to and including 0.9 is vulnerable. The plugin is distributed via the official WordPress plugin directory at wordpress.org/plugins/wp-bookwidgets. WordPress installations with contributor-level or higher roles are at risk if this plugin is active.

RemediationAI

Update the WP BookWidgets plugin to a patched version released after 0.9. The vendor has committed a fix (changeset 3380322 visible in the WordPress plugin repository), and administrators should update to the latest available version from the WordPress plugin directory. Administrators should verify the update addresses the 'bw_link' shortcode sanitization and escaping issues. Until patched, review and audit any contributors or editors with access to create or edit posts/pages containing the 'bw_link' shortcode to detect and remove any suspicious shortcode attributes. Additional hardening includes restricting contributor-level permissions to trusted users only and using a Web Application Firewall configured to detect stored XSS patterns.

CVE-2025-10139 vulnerability details – vuln.today

Back