Stored Cross-Site Scripting in WP ViewSTL Plugin for WordPress

CVE-2025-10135

What is CVE-2025-10135?

The WP ViewSTL plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate sanitization of user input and failure to properly escape output. This vulnerability allows authenticated users with contributor-level permissions or higher to inject malicious script code into pages, potentially executing those scripts in the context of other users accessing the compromised pages. Proper security measures should be taken to mitigate this risk and ensure user data integrity.

References