CVE-2025-10179: My AskAI WordPress Plugin XSS Vulnerability

CVE-2025-10179 Overview

The My AskAI plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the myaskai shortcode. The flaw affects all plugin versions up to and including 1.0.0. The plugin fails to sanitize input and escape output on user-supplied shortcode attributes. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages. The injected scripts execute in the browser of any user who visits the affected page. The issue is tracked as CWE-79 and reported through the Wordfence Vulnerability Report.

Critical Impact

Authenticated contributors can persist malicious JavaScript that runs against any site visitor, enabling session theft, redirection, and administrative account takeover.

Affected Products

• WordPress My AskAI plugin versions up to and including 1.0.0
• WordPress sites permitting contributor-level or higher user registration
• Any WordPress instance where the My AskAI shortcode is enabled

Discovery Timeline

• 2025-09-30 - CVE-2025-10179 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10179

Vulnerability Analysis

The My AskAI plugin registers a myaskai shortcode that accepts user-controlled attributes. The plugin renders these attribute values directly into page output without applying WordPress escaping helpers such as esc_attr() or esc_html(). It also does not sanitize inbound values with sanitize_text_field() or an equivalent function.

Contributors in WordPress can author draft posts containing shortcodes. When an editor or administrator previews or publishes the post, the plugin expands the shortcode with the attacker-supplied attributes intact. The resulting HTML contains attacker-controlled JavaScript that executes in the browser session of privileged users and visitors.

Stored XSS in a WordPress context frequently escalates to full site compromise. Scripts executing under an administrator session can create new admin users, modify plugin files, or inject persistent backdoors. Refer to the plugin source at line 40 for the vulnerable rendering path.

Root Cause

The vulnerability stems from insufficient input sanitization and missing output escaping on shortcode attributes handled by myaskai.php. The plugin trusts the shortcode attribute array returned by WordPress and concatenates values directly into HTML.

Attack Vector

An attacker registers or compromises a contributor-level account on the target WordPress site. The attacker submits a post or page containing the myaskai shortcode with a malicious attribute payload. When any user renders the affected page, the injected script executes with the privileges of the viewer's session.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in the Wordfence advisory.

Detection Methods for CVE-2025-10179

Indicators of Compromise

• Post or page content containing [myaskai ...] shortcodes with attributes that include <script>, javascript:, onerror=, or other event handlers
• Unexpected outbound requests from browser sessions of administrators viewing plugin-rendered pages
• Creation of new administrator accounts or modification of user roles immediately after a contributor submits content
• New or modified plugin and theme files following a privileged user's page view

Detection Strategies

• Audit the wp_posts table for post_content values matching the myaskai shortcode combined with suspicious HTML or JavaScript tokens
• Review contributor account activity, including post submissions and revision history, for injected shortcode attributes
• Enable Content Security Policy (CSP) reporting to surface inline script violations originating from published pages

Monitoring Recommendations

• Log all shortcode-rendered output on staging environments before publishing to production
• Alert on WordPress user role changes, plugin file modifications, and new administrator creation events
• Monitor web server access logs for anomalous requests originating from authenticated editor and administrator sessions

How to Mitigate CVE-2025-10179

Immediate Actions Required

• Deactivate the My AskAI plugin until a patched version is published by the vendor
• Audit all existing posts and pages for the myaskai shortcode and remove any suspicious attribute values
• Review contributor and author accounts; disable or reset credentials for untrusted or dormant users
• Rotate administrator session cookies and enforce password resets for privileged accounts

Patch Information

No fixed version is listed in the enriched data at the time of publication. All versions up to and including 1.0.0 remain vulnerable. Monitor the WordPress plugin repository and the Wordfence advisory for an updated release.

Workarounds

• Restrict contributor-level registrations and require manual approval for new user accounts
• Remove or block the myaskai shortcode using remove_shortcode('myaskai') in a mu-plugin until a fix is available
• Deploy a web application firewall (WAF) rule to strip HTML tags and event handlers from shortcode attributes submitted in post content
• Apply a strict Content Security Policy that disallows inline scripts on published pages

# Configuration example: disable the vulnerable shortcode via a must-use plugin
# File: wp-content/mu-plugins/disable-myaskai.php
<?php
add_action('init', function () {
    if (shortcode_exists('myaskai')) {
        remove_shortcode('myaskai');
    }
}, 20);