Stored Cross-Site Scripting Vulnerability in Digiseller Plugin for WordPress

CVE-2025-10141

What is CVE-2025-10141?

The Digiseller plugin for WordPress suffers from a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input validation and output escaping. This flaw allows authenticated attackers with contributor-level access or higher to inject malicious scripts through the 'ds' shortcode. These scripts can execute whenever a user accesses a vulnerable page, potentially compromising user sessions and data integrity.

References