CVE-2025-10636

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10636", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2025-09-17T13:29:16.380Z", "datePublished": "2025-10-30T06:00:07.969Z", "dateUpdated": "2026-04-02T12:39:50.549Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-04-02T12:39:50.549Z"}, "title": "NS Maintenance Mode for WP <= 1.3.1 - Admin+ Stored XSS", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "NS Maintenance Mode for WP", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "1.3.1"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)."}], "references": [{"url": "https://wpscan.com/vulnerability/a1ab1d82-108e-4f66-9d06-5036cde9678a/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Bob Matyas", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-30T14:08:47.293912Z", "id": "CVE-2025-10636", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T14:09:05.103Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-10636", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-30T14:08:47.293912Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T14:08:25.824Z"}}], "cna": {"title": "NS Maintenance Mode for WP <= 1.3.1 - Admin+ Stored XSS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Bob Matyas"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "NS Maintenance Mode for WP", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.1"}], "defaultStatus": "unknown"}], "references": [{"url": "https://wpscan.com/vulnerability/a1ab1d82-108e-4f66-9d06-5036cde9678a/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-79 Cross-Site Scripting (XSS)"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-04-02T12:39:50.549Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10636", "state": "PUBLISHED", "dateUpdated": "2026-04-02T12:39:50.549Z", "dateReserved": "2025-09-17T13:29:16.380Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2025-10-30T06:00:07.969Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "NS Maintenance Mode for WP", "vendor": "Unknown", "versions": [{"lessThanOrEqual": "1.3.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)."}, {"lang": "es", "value": "El plugin de WordPress NS Maintenance Mode for WP hasta la versi\u00f3n 1.3.1 no sanitiza ni escapa algunas de sus configuraciones, lo que podr\u00eda permitir a usuarios con altos privilegios, como los administradores, realizar ataques de cross-site scripting almacenado incluso cuando la capacidad unfiltered_html est\u00e1 deshabilitada (por ejemplo, en una configuraci\u00f3n multisitio)."}], "id": "CVE-2025-10636", "lastModified": "2026-10-08T10:10:00.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10636", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-30T14:08:47.293912Z", "version": "2.0.3"}}]}, "published": "2025-10-30T06:15:43.577", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/a1ab1d82-108e-4f66-9d06-5036cde9678a/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Deferred"}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T10:36:04.483898+00:00", "value": {"mitigation_remediation": ["Update the NS Maintenance Mode for WP plugin to the latest version, which includes proper input sanitisation.", "If an update cannot be performed immediately, disable the plugin or remove the configuration pages that accept user input to prevent the injection of malicious code.", "Deploy a content\u2011security\u2011policy that blocks inline scripts or restricts script sources to mitigate the impact should malicious content be stored."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites running the NS Maintenance Mode for WP plugin version 1.3.1 or earlier. The plugin is installed on any WordPress installation, including multisite networks. Administrators can trigger the flaw through the plugin\u2019s settings interface, and the malicious script is persisted in the database for all visitors.", "description_and_impact": "The vulnerability exists because the NS Maintenance Mode for WP WordPress plugin through version 1.3.1 accepts input in certain settings without sanitising or escaping it. An administrator can insert malicious script that is stored in the database and rendered in the front\u2011end when the site is viewed, even when the unfiltered_html capability is disabled in a multisite environment. This allows the attacker to perform stored cross\u2011site scripting, which could lead to session hijacking, credential theft, or the execution of arbitrary code in the context of authenticated users.", "risk_and_exploitability": "The CVSS score of 3.5 indicates a low severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. This stored cross\u2011site scripting vulnerability requires that an attacker has administrative privileges to inject malicious content via the plugin\u2019s settings interface. It is not listed in CISA\u2019s KEV catalog. Once the attacker achieves this injection, the stored script will be delivered to all visitors, providing a persistent client\u2011side compromise."}}}}, "created": "2025-10-30T14:37:14.064887+00:00", "updated": "2026-04-28T10:45:29.415958+00:00", "vendors": ["nsthemes", "nsthemes$PRODUCT$ns_maintenance_mode_for_wp", "wordpress", "wordpress$PRODUCT$wordpress"]}