CVE-2025-10135: 
WordPress vulnerability analysis and mitigation

The WP ViewSTL plugin for WordPress contains a Stored Cross-Site Scripting vulnerability via the plugin's 'viewstl' shortcode. The vulnerability was discovered and publicly disclosed on October 14, 2025, with the plugin being temporarily closed pending a full security review. This vulnerability affects versions up to 1.0 of the WP ViewSTL plugin (Wordfence, WordPress Plugin).

The vulnerability has been assigned a CVSS v3.1 score of 6.4 (Medium), indicating a moderate severity level. The vulnerability requires authentication at the Contributor level or higher to exploit, suggesting some access control restrictions are in place (Wordfence).

When successfully exploited, this vulnerability allows authenticated users with Contributor or higher privileges to store and execute malicious scripts that can affect other users who view the affected pages. This could lead to session hijacking, credential theft, or other client-side attacks against site administrators and users (Wordfence).

As of October 14, 2025, the plugin has been temporarily closed and is not available for download pending a full security review. Site administrators using the WP ViewSTL plugin should consider disabling it until a patched version is released (WordPress Plugin).