CVE-2025-10141

MEDIUM

2025-10-15 [email protected]

WordPress XSS

6.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Oct 15, 2025 - 09:15 nvd

MEDIUM 6.4

DescriptionNVD

The Digiseller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ds' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting (XSS) in the Digiseller WordPress plugin up to version 1.3 allows authenticated contributors and above to inject arbitrary JavaScript via the 'ds' shortcode attributes due to insufficient input sanitization and output escaping. The injected scripts execute in the context of all users viewing the affected page, enabling session hijacking, credential theft, or malware distribution. CVSS 6.4 reflects network accessibility and lower-privileged attacker requirements; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The Digiseller plugin processes user-supplied input through the 'ds' WordPress shortcode without proper sanitization or escaping. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), where the plugin accepts shortcode attributes directly from authenticated users and renders them in the page output without passing them through WordPress security functions such as wp_kses_post() or esc_attr(). The root cause is inadequate use of WordPress escaping APIs during shortcode attribute processing. This affects the plugin's core shortcode handler referenced at line 61 of digiseller.php, allowing stored malicious payloads to persist in page content and execute whenever the page is accessed.

Affected ProductsAI

The Digiseller WordPress plugin in all versions up to and including 1.3 is affected. The plugin is distributed through the official WordPress plugin repository at wordpress.org/plugins/digiseller. Administrators should consult the plugin's change log and advisory page for the exact patched version number, available through the WordPress Plugins Trac at plugins.trac.wordpress.org/changeset/3394885/.

RemediationAI

Update the Digiseller plugin to the latest version beyond 1.3 (exact version number available through the plugin repository update mechanism). The WordPress Plugins Trac changeset 3394885 contains the upstream fix addressing input sanitization and output escaping. Administrators unable to update immediately should restrict contributor-level access to only trusted users and monitor page content for unusual shortcode attributes. The vulnerability is stored, so any injected content must be removed from affected pages manually if a compromise is suspected. Consult the Wordfence vulnerability advisory at www.wordfence.com/threat-intel/vulnerabilities/id/d783b6ca-940c-4939-b96a-339419d8ed56 for additional context and updates.

CVE-2025-10141 vulnerability details – vuln.today

Back