CVE-2025-10132: WordPress Dhivehi Text Plugin XSS Vulnerability

CVE-2025-10132 Overview

The Dhivehi Text plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in its dhivehi shortcode. All versions up to and including 0.1 fail to sanitize user-supplied attributes and properly escape output. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views the affected page, including administrators. Wordfence assigned the vulnerability an EPSS probability of 0.219% at the time of publication.

Critical Impact

Contributor-level accounts can inject persistent JavaScript that executes in administrator browsers, enabling session theft, privilege escalation, and site takeover.

Affected Products

• Dhivehi Text plugin for WordPress, all versions through 0.1
• WordPress sites permitting contributor-level registrations or above
• Any WordPress installation with the plugin active and shortcode processing enabled

Discovery Timeline

• 2025-10-15 - CVE-2025-10132 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10132

Vulnerability Analysis

The vulnerability resides in the dhivehi shortcode handler within dhivehi-text.php. The plugin accepts user-controlled attributes through the shortcode but does not apply WordPress sanitization functions such as sanitize_text_field() or escape output using esc_attr() and esc_html(). Content passed through shortcode attributes is rendered directly into page markup. An authenticated contributor can embed the shortcode in a draft post with a malicious attribute value containing HTML or JavaScript payloads. When an editor or administrator previews or publishes the content, the payload executes in their authenticated browser context. Refer to the WordPress Plugin Code Reference for the vulnerable handler.

Root Cause

The root cause is missing input sanitization on shortcode attribute values and missing output escaping when those values are rendered into HTML. WordPress requires plugin authors to explicitly filter shortcode inputs; the Dhivehi Text plugin omits this step at the shortcode registration point.

Attack Vector

An attacker with contributor privileges authors a post containing the dhivehi shortcode with a crafted attribute holding a script payload. The stored payload persists in the database. When any authenticated user, including higher-privileged roles, views the rendered page, the browser executes the injected script. Because the scope is changed (S:C in the CVSS vector), the attack can affect resources beyond the vulnerable component, such as administrator sessions. Additional analysis is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-10132

Indicators of Compromise

• Post or page content in wp_posts containing [dhivehi ...] shortcodes with attribute values holding <script>, onerror=, onload=, or javascript: strings
• Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing plugin-rendered pages
• New administrator accounts or modified user roles created shortly after content authored by contributor accounts is viewed by admins

Detection Strategies

• Query the WordPress database for shortcode attributes containing HTML event handlers or script tags
• Review audit logs for contributor-level users creating or editing posts that include the dhivehi shortcode
• Deploy a Web Application Firewall (WAF) rule that inspects POST bodies for shortcode attributes containing script payloads

Monitoring Recommendations

• Enable WordPress activity logging plugins to record shortcode-containing post revisions per author role
• Monitor browser Content Security Policy (CSP) violation reports for inline-script executions on plugin-rendered pages
• Alert on privilege changes, plugin installations, and option modifications that occur within a short window after administrators view contributor-authored content

How to Mitigate CVE-2025-10132

Immediate Actions Required

• Deactivate and remove the Dhivehi Text plugin until a patched release becomes available
• Audit all existing posts and pages for the dhivehi shortcode and remove or sanitize suspicious attribute values
• Restrict contributor and author role assignments to trusted users only
• Rotate credentials and force session invalidation for administrator accounts that may have viewed injected content

Patch Information

At the time of the last NVD update on 2026-06-17, no patched version beyond 0.1 was referenced in the advisory. Site operators should monitor the Wordfence Vulnerability Report and the plugin's WordPress.org listing for a fixed release.

Workarounds

• Uninstall the plugin entirely if a Dhivehi text rendering capability is not required
• Remove contributor and author accounts, or restrict them to roles that cannot publish shortcodes
• Deploy a strict Content Security Policy that blocks inline script execution on the WordPress front end
• Configure a WAF rule to strip or block requests containing the dhivehi shortcode with HTML-bearing attributes

# Example: locate posts containing the vulnerable shortcode
wp db query "SELECT ID, post_author, post_status FROM wp_posts \
  WHERE post_content LIKE '%[dhivehi%' AND \
  (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' \
   OR post_content LIKE '%javascript:%');"

# Deactivate the plugin via WP-CLI
wp plugin deactivate dhivehi-text
wp plugin uninstall dhivehi-text