Stored Cross-Site Scripting Vulnerability in WP BookWidgets Plugin by WordPress

CVE-2025-10139

What is CVE-2025-10139?

The WP BookWidgets plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the plugin's 'bw_link' shortcode. As a result, authenticated users with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts. The injected scripts are executed whenever a user accesses a page containing the injected content, potentially compromising user data and site integrity.

References