CVE-2025-10128

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10128", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-08T19:18:38.345Z", "datePublished": "2025-09-30T03:35:32.618Z", "dateUpdated": "2026-04-08T17:28:46.840Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:46.840Z"}, "affected": [{"vendor": "michaellow", "product": "Eulerpool Research Systems", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Eulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0b4267b-2929-489b-86b8-cd256708c5bd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/alleaktien-quantitativ/trunk/aaq-fundamentals-plugin.php#L36"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "cweId": "CWE-80", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-09-29T15:27:49.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-30T15:37:30.435956Z", "id": "CVE-2025-10128", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T15:37:41.439Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10128", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-30T15:37:30.435956Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T15:37:35.652Z"}}], "cna": {"title": "Eulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "michaellow", "product": "Eulerpool Research Systems", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.0.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-29T15:27:49.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0b4267b-2929-489b-86b8-cd256708c5bd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/alleaktien-quantitativ/trunk/aaq-fundamentals-plugin.php#L36"}], "descriptions": [{"lang": "en", "value": "The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-30T03:35:32.618Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10128", "state": "PUBLISHED", "dateUpdated": "2025-09-30T15:37:41.439Z", "dateReserved": "2025-09-08T19:18:38.345Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-30T03:35:32.618Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Eulerpool Research Systems", "vendor": "michaellow", "versions": [{"lessThanOrEqual": "4.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Eulerpool Research Systems para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode 'aaq' del plugin en todas las versiones hasta la 4.0.1, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de nivel de colaborador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-10128", "lastModified": "2026-10-09T09:10:00.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10128", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-30T15:37:30.435956Z", "version": "2.0.3"}}]}, "published": "2025-09-30T11:37:37.023", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/alleaktien-quantitativ/trunk/aaq-fundamentals-plugin.php#L36"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0b4267b-2929-489b-86b8-cd256708c5bd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-80"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:41:32.269634+00:00", "value": {"mitigation_remediation": ["Upgrade the Eulerpool Research Systems plugin to the latest available version (4.0.2 or newer).", "If an upgrade cannot be applied immediately, deactivate or delete the plugin to eliminate the vulnerability.", "Restrict or remove contributor accounts that do not need that role to reduce the attack surface."], "summary": {"action": "Update Plugin", "impact": "Stored Cross-Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerable product is the Eulerpool Research Systems plugin, version 4.0.1 and all earlier releases, supplied by the vendor michaellow. All WordPress sites running any of these versions are affected and are at risk if contributors are allowed to add or edit content.", "description_and_impact": "The Eulerpool Research Systems WordPress plugin contains a stored cross\u2011site scripting flaw in its 'aaq' shortcode, where insufficient input sanitization allows an attacker with contributor\u2011level or higher access to insert arbitrary scripts that run whenever a page containing the shortcode is viewed. This can lead to site defacement, cookie theft, session hijacking, or other malicious actions performed as the visiting user. The weakness is a classic stored XSS, identified as CWE\u201180.", "risk_and_exploitability": "The CVSS score is 6.4, indicating medium severity, while the EPSS score is below 1%, suggesting a low likelihood of exploitation at present. This vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated access, a threat actor would need to be an existing contributor or higher; however, once authenticated, a malicious contributor can very easily inject scripts that compromise subsequent site visitors."}}}}, "created": "2025-09-30T08:47:23.698882+00:00", "updated": "2026-04-21T02:45:25.954389+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}