CVE-2025-10139
BaseFortify
Publication date: 2025-10-15
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| remko | wp_bookwidgets | 0.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WP BookWidgets plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in its 'bw_link' shortcode in all versions up to and including 0.9. This vulnerability arises because the plugin does not properly sanitize or escape user-supplied attributes. As a result, authenticated users with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute whenever any user accesses the injected page, potentially compromising site security.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with contributor-level access or higher to inject malicious scripts into WordPress pages via the 'bw_link' shortcode. When other users visit these pages, the injected scripts execute in their browsers, which can lead to theft of session cookies, defacement, unauthorized actions performed on behalf of users, or distribution of malware. This compromises the integrity and security of the affected WordPress site and its users.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by identifying if the WP BookWidgets plugin version 0.9 or earlier is installed and active on your WordPress site. Since the vulnerability involves stored Cross-Site Scripting via the 'bw_link' shortcode, you can look for pages or posts containing this shortcode with suspicious or unexpected script content. There are no specific commands provided in the resources to detect the vulnerability on your network or system. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or uninstalling the WP BookWidgets plugin if it is installed, especially versions up to and including 0.9. Since the plugin has been closed and is unavailable for download as of October 14, 2025, avoid using it until a secure version is released. Additionally, restrict contributor-level access and above to trusted users only, as the vulnerability requires authenticated contributor-level access to exploit. Monitor and sanitize any user inputs related to the 'bw_link' shortcode if you must continue using the plugin. [2]