Stored Cross-Site Scripting in Eulerpool Research Systems Plugin for WordPress
CVE-2025-10128
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 30 September 2025
What is CVE-2025-10128?
The Eulerpool Research Systems plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'aaq' shortcode. This flaw arises from inadequate input sanitization and output escaping for user-supplied attributes, allowing authenticated attackers with contributor-level access and higher to inject malicious web scripts into pages. These scripts can execute when a user visits the compromised page, posing a significant risk to site security and user data.
Affected Version(s)
Eulerpool Research Systems * <= 4.0.1