CVE-2025-10128: Eulerpool Research Systems Plugin XSS Flaw

CVE-2025-10128 Overview

CVE-2025-10128 is a Stored Cross-Site Scripting (XSS) vulnerability in the Eulerpool Research Systems plugin for WordPress. The flaw exists in the plugin's aaq shortcode and affects all versions up to and including 4.0.1. The plugin fails to sanitize user-supplied attributes and does not escape output properly. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes when other users view the affected page. The weakness is classified as CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.

Critical Impact
Authenticated contributors can inject persistent JavaScript that runs in the browser sessions of visitors and site administrators, enabling session theft, forced administrative actions, and content manipulation.

Affected Products

Eulerpool Research Systems plugin for WordPress
All versions up to and including 4.0.1
WordPress sites that expose contributor-level (or higher) accounts to untrusted users

Discovery Timeline

2025-09-30 - CVE-2025-10128 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10128

Vulnerability Analysis

The vulnerability resides in the plugin's aaq shortcode handler defined in aaq-fundamentals-plugin.php. WordPress shortcodes accept attributes supplied by post authors, and those attributes must be sanitized before use and escaped before output. The Eulerpool Research Systems plugin performs neither step for the aaq shortcode attributes. As a result, attribute values are rendered directly into the page HTML.

An authenticated attacker with contributor privileges can craft a post containing the shortcode with malicious attribute values. When any user, including administrators, loads the resulting page, the injected script executes in their browser under the site's origin. This produces cross-scope impact because the payload runs in a different security context than the attacker's own.

Root Cause

The root cause is missing input sanitization and missing output escaping on shortcode attributes. WordPress provides helper functions such as sanitize_text_field() for input and esc_attr() or esc_html() for output. The vulnerable code path passes attacker-controlled attribute values into the HTML response without invoking these functions, allowing HTML and JavaScript to be interpreted by the browser.

Attack Vector

Exploitation requires an authenticated account with contributor-level access or above and network access to the WordPress site. The attacker publishes or submits content containing the aaq shortcode with a JavaScript payload embedded in one of its attributes. When a reviewer, editor, administrator, or site visitor renders the page, the payload executes. Typical follow-on actions include stealing authentication cookies, performing privileged operations through the victim's session, and pivoting to full site takeover if an administrator triggers the payload. See the WordPress Plugin Code Review and the Wordfence Vulnerability Report for the affected source location.

Detection Methods for CVE-2025-10128

Indicators of Compromise

Posts, pages, or custom post types containing the [aaq] shortcode with attribute values that include <script>, javascript:, or HTML event handlers such as onerror= and onload=.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading plugin-rendered pages.
New administrator accounts, changed user roles, or unauthorized plugin installations following contributor account activity.

Detection Strategies

Query the wp_posts table for post_content values matching the aaq shortcode combined with suspicious attribute patterns.
Deploy a web application firewall rule that flags shortcode attributes containing angle brackets, quote-escape sequences, or JavaScript URI schemes.
Review the audit trail for contributor accounts that submit or edit posts containing the plugin's shortcodes.

Monitoring Recommendations

Monitor WordPress access logs for POST requests to wp-admin/post.php and admin-ajax.php originating from contributor accounts.
Track browser Content Security Policy (CSP) violation reports for inline script execution on plugin-rendered pages.
Alert on privilege changes, password resets, and plugin or theme file modifications performed within a short window after administrator page views.

How to Mitigate CVE-2025-10128

Immediate Actions Required

Update the Eulerpool Research Systems plugin to a version later than 4.0.1 once the vendor publishes a patched release.
Audit existing posts and pages for the [aaq] shortcode and remove any entries containing script fragments or event-handler attributes.
Restrict contributor-level account creation and revoke unused contributor accounts to reduce the attacker population.

Patch Information

At the time of the last NVD update, the Wordfence Vulnerability Report lists all versions through 4.0.1 as vulnerable. Site owners should track the plugin's changelog and apply the vendor-supplied fix as soon as it is released. Until then, treat the plugin as vulnerable in every installed version.

Workarounds

Deactivate and remove the Eulerpool Research Systems plugin until a patched version is available.
Enforce a strict Content Security Policy that disallows inline scripts on WordPress-rendered pages to limit XSS payload execution.
Require editorial review of contributor submissions and reject posts that contain raw HTML or shortcodes with script-like attribute values.

bash

# Temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate alleaktien-quantitativ
wp plugin delete alleaktien-quantitativ

# Search the database for the vulnerable shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[aaq%';"