CVE-2025-10125: 
WordPress Análise e mitigação de vulnerabilidades

The vulnerability CVE-2025-10125 affects the Memberlite Shortcodes WordPress plugin versions up to 1.4. This authenticated Stored Cross-Site Scripting vulnerability was discovered and publicly disclosed on September 16, 2025, with a CVSS score of 6.4 (Medium) (Wordfence).

The vulnerability exists in the row shortcode implementation within the Memberlite Shortcodes plugin, specifically in the handling of the 'class' attribute. The issue was addressed in version 1.4.1 released on September 10, 2025, which included security fixes for sanitizing and escaping the 'class' shortcode attribute in the row shortcode (WordPress Plugin).

The vulnerability allows authenticated users with Contributor or higher privileges to perform Stored Cross-Site Scripting attacks through the plugin's shortcode functionality (Wordfence).

Site administrators should update to Memberlite Shortcodes version 1.4.1 or later, which includes the security fix for this vulnerability. The update specifically addresses the vulnerability by implementing proper sanitization and escaping of the 'class' shortcode attribute in the row shortcode (WordPress Plugin).