CVE-2025-10180: 
WordPress vulnerability analysis and mitigation

The Markdown Shortcode plugin for WordPress (versions up to 0.2.1) contains a Stored Cross-Site Scripting vulnerability (CVE-2025-10180) discovered in September 2025. The vulnerability exists in the plugin's 'markdown' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes (NVD).

The vulnerability stems from improper input sanitization and output escaping in the markdown shortcode functionality. It has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating network accessibility with low attack complexity and requiring low privileges (Wordfence).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to compromised user sessions and data theft (NVD).

The vulnerability has been patched in version 0.2.3 of the Markdown Shortcode plugin. The fix implements wpksespost() sanitization to the markdown output, which removes dangerous HTML tags while preserving legitimate markdown-generated HTML. Users are strongly advised to update to version 0.2.3 immediately (GitHub).