CVE-2025-10357: 
WordPress vulnerability analysis and mitigation

The Simple SEO WordPress plugin before version 2.0.32 contains a Cross-Site Scripting (XSS) vulnerability that affects users with contributor-level permissions or higher. This security issue was discovered and reported by Krugov Artyom from CleanTalk, and was assigned CVE-2025-10357 (WPScan).

The vulnerability stems from improper sanitization and escaping of parameters when outputting them in the page. The issue has been assigned a CVSS 3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified under CWE-79 (Cross-Site Scripting) and is part of the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

The vulnerability allows users with contributor-level access or higher to perform Cross-Site Scripting attacks. This could potentially lead to unauthorized script execution in users' browsers, potentially compromising sensitive information or performing actions on behalf of other users (WPScan).

The vulnerability has been fixed in version 2.0.32 of the Simple SEO WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).