Stored XSS Vulnerability in AP Background Plugin for WordPress

CVE-2025-10165

What is CVE-2025-10165?

The AP Background plugin for WordPress contains a vulnerability that enables Stored Cross-Site Scripting through its 'adv_parallax_back' shortcode. This issue arises from a lack of proper input sanitization and output escaping for user-supplied attributes. As a result, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts are executed whenever a user accesses the affected pages, which can lead to unauthorized actions and data exposure. Users are encouraged to review their plugin versions and apply necessary updates to mitigate this security risk.

References