CVE-2025-10138 Overview
CVE-2025-10138 is a Stored Cross-Site Scripting (XSS) vulnerability in the This-or-That plugin for WordPress. The flaw affects all versions up to and including 1.0.4. It stems from insufficient input sanitization and output escaping on user-supplied attributes passed to the plugin's thisorthat shortcode. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts into pages. Those scripts execute in the browser of any user who accesses the injected page. The issue is tracked under CWE-79.
Critical Impact
Contributor-level users can persist JavaScript payloads that run in the context of site visitors and administrators, enabling session theft, forced administrative actions, and site defacement.
Affected Products
- This-or-That WordPress plugin — all versions up to and including 1.0.4
- WordPress sites where the plugin is active and untrusted Contributor accounts exist
- Any page or post rendered with the vulnerable thisorthat shortcode
Discovery Timeline
- 2025-10-22 - CVE-2025-10138 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10138
Vulnerability Analysis
The This-or-That plugin registers a thisorthat shortcode used to render poll-style content in WordPress posts and pages. The shortcode handler accepts attributes supplied by the post author and echoes them into the rendered HTML. The plugin does not sufficiently sanitize input on the way in, and it does not properly escape output when generating the page markup. As a result, attribute values containing HTML or JavaScript are emitted verbatim into the DOM.
Because WordPress Contributor accounts can author posts containing shortcodes, the trust boundary is crossed by any user at or above the Contributor role. When an editor, administrator, or site visitor loads a page containing the malicious shortcode invocation, the injected script executes in their browser session. See the WordPress plugin source reference for the affected code path.
Root Cause
The root cause is a classic failure of the two defenses required to prevent stored XSS: input sanitization using functions such as sanitize_text_field() or wp_kses(), and context-aware output escaping using esc_attr() or esc_html(). The shortcode handler at line 232 of this-or-that.php interpolates attribute values directly into the response, allowing HTML control characters and <script> tags to be rendered as active content.
Attack Vector
An authenticated attacker with at least Contributor privileges creates or edits a post containing the thisorthat shortcode with an attribute value carrying an XSS payload. The malicious content is stored in the WordPress database. When any visitor or logged-in user renders the post, the payload executes with the privileges of that user's browser session. If an administrator views the page, the attacker can hijack the session, create new privileged users, or install additional plugins.
No verified public proof-of-concept code is available. Refer to the Wordfence vulnerability report for additional technical detail.
Detection Methods for CVE-2025-10138
Indicators of Compromise
- Post or page content containing [thisorthat ...] shortcodes with attribute values that include <script>, onerror=, onload=, javascript:, or encoded equivalents.
- Unexpected outbound requests from browsers viewing content pages to attacker-controlled domains.
- New administrator accounts, changed user roles, or plugin installations correlating with a Contributor account editing shortcode content.
Detection Strategies
- Query the wp_posts table for post_content matching the thisorthat shortcode and inspect attribute values for HTML or JavaScript characters.
- Review WordPress audit logs for Contributor accounts creating or updating posts that use the vulnerable shortcode.
- Deploy a web application firewall (WAF) rule that inspects submitted post content for script tags inside shortcode attributes.
Monitoring Recommendations
- Alert on Content Security Policy (CSP) violation reports originating from pages that render the thisorthat shortcode.
- Monitor administrative session activity following visits to pages authored by lower-privileged users.
- Track plugin version inventory across managed WordPress instances to identify hosts still running This-or-That 1.0.4 or earlier.
How to Mitigate CVE-2025-10138
Immediate Actions Required
- Update the This-or-That plugin to a version above 1.0.4 once released by the vendor, or deactivate and remove the plugin.
- Audit existing posts and pages for malicious thisorthat shortcode attributes and sanitize or delete offending content.
- Review the Contributor and Author role assignments and revoke access for accounts that do not require post authoring.
Patch Information
A fixed release above 1.0.4 should be applied when available. Consult the Wordfence advisory and the WordPress plugin repository for the current patched version and changelog. Until an official fix is confirmed, treat deactivation as the safest remediation.
Workarounds
- Deactivate the This-or-That plugin until a patched version is installed.
- Restrict shortcode usage by limiting Contributor and Author roles or by filtering the thisorthat shortcode out of untrusted post content with a the_content filter.
- Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.