WP Easy Toggles CVE-2025-10190

Exploitation requires an authenticated account with contributor-level capability or higher on the target WordPress site, and the WP Easy Toggles plugin (version ≤1.9.0) must be installed and active so the 'toggles' shortcode is available. The injection occurs through user-supplied attributes passed to that specific shortcode, which the plugin fails to sanitize on input or escape on output. The payload only executes when another user (visitor, editor, or administrator) subsequently accesses the page containing the injected shortcode, so impact depends on that page being viewed. Primary limiting factors: the contributor-account prerequisite (PR:L) means anonymous attackers cannot exploit it directly, making open/untrusted user registration the main risk amplifier; no special non-default configuration is otherwise needed beyond having the plugin active.

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that is a real but low-urgency issue rather than an emergency. The CVSS vector confirms network attack vector, low complexity, and NO user interaction for injection, but critically requires PR:L - the attacker must already hold an authenticated contributor-level (or higher) account, which meaningfully narrows the realistic attacker population. The scope change (S:C) reflects that injected scripts execute in the browser context of other users/visitors, raising impact above a self-contained flaw, though confidentiality and integrity impacts are only Low and availability is None. All signals agree this is low-to-moderate real-world priority: EPSS is 0.23% (13th percentile), indicating low predicted exploitation likelihood; there is no CISA KEV listing and no public exploit code identified. There is no conflict between signals - the low EPSS, absence of KEV, and the authentication prerequisite are mutually consistent with a vulnerability that is genuine but not a mass-exploitation target. The main caveat is trust model: sites that allow untrusted contributor registrations face more exposure than those where contributor accounts are tightly controlled.

An attacker who holds or obtains a contributor-level WordPress account crafts a post or page using the plugin's 'toggles' shortcode with malicious attribute values containing JavaScript, which is stored without sanitization. When an administrator, editor, or site visitor later views that page, the script executes in their browser, enabling session/cookie theft or actions in the victim's context. No public proof-of-concept exploit has been identified at time of analysis.