CVE-2025-10125

MediumCVSS 6.4

Published: 17/09/2025(UTC)Updated: 26/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

The Memberlite Shortcodes plugin for WordPress (all versions up to and including 1.4) is vulnerable to stored Cross-Site Scripting via the 'row' shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts.

Risk Assessment

An authenticated attacker with Contributor-level access or higher can inject malicious JavaScript that executes in visitors' browsers. This can lead to session theft or content modification.

Recommendation

Update the Memberlite Shortcodes plugin to a version newer than 1.4. Consider restricting Contributor privileges until the update is applied.

Other vulnerabilities in Memberlite Shortcodes

CVE-2025-48087Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason C. Memberlite Shortcodes memberlite-shortcodes allows Stored XSS.This issue affects Memberlite Shortcodes: from n/a through 1.4.1.

Original NVD description (English source)

The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'row' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS