CVE-2025-10189 Overview
CVE-2025-10189 is a Stored Cross-Site Scripting (XSS) vulnerability in the BP Direct Menus plugin for WordPress. The flaw affects all versions up to and including 1.0.0. It stems from insufficient input sanitization and output escaping on user-supplied attributes passed to the plugin's bpdm_login shortcode. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads the affected page. The vulnerability is classified under [CWE-79].
Critical Impact
Authenticated contributors can inject persistent JavaScript through the bpdm_login shortcode, enabling session hijacking, credential theft, or forced administrative actions when a privileged user views the affected page.
Affected Products
- BP Direct Menus plugin for WordPress
- All versions through 1.0.0
- WordPress sites permitting contributor-level accounts
Discovery Timeline
- 2025-09-30 - CVE-2025-10189 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10189
Vulnerability Analysis
The BP Direct Menus plugin registers a shortcode named bpdm_login that accepts user-supplied attributes. The plugin does not sanitize these attributes on input and does not escape them on output when rendering the shortcode to the page. As a result, attribute values flow directly into the HTML response.
A contributor who embeds the shortcode in a post or page can supply attribute values containing HTML or JavaScript payloads. Once the content is published or previewed by another user, the browser parses the injected markup and executes any attacker-controlled script in the context of the site. Because the payload is stored in the database, every visitor to the injected page triggers execution. See the WordPress Plugin Code Reference and the Wordfence Vulnerability Report for the affected code path.
Root Cause
The root cause is missing input validation on shortcode attributes combined with missing output escaping when the shortcode handler emits HTML. WordPress provides functions such as esc_attr(), esc_html(), and wp_kses() for this purpose, but the plugin's frontend renderer does not apply them to the attributes accepted by bpdm_login.
Attack Vector
An attacker needs an authenticated account with the contributor role or higher on the target WordPress site. The attacker creates or edits a post containing the bpdm_login shortcode and supplies a crafted attribute value carrying JavaScript. When the content is rendered, the payload executes in the browsers of viewers, including editors and administrators who preview or review the submission. This yields impact against confidentiality and integrity in the visitor's session, and can be leveraged to escalate privileges through forged administrative requests.
No verified public exploit code is available. The vulnerability is described in prose based on the referenced advisory.
Detection Methods for CVE-2025-10189
Indicators of Compromise
- Post or page content containing the bpdm_login shortcode with attribute values that include <script>, onerror=, onload=, or javascript: sequences.
- Unexpected outbound requests from browser sessions of editors or administrators shortly after previewing contributor-submitted content.
- New administrative users, changed passwords, or modified plugin settings created without a corresponding admin login event.
Detection Strategies
- Query the wp_posts table for post_content values matching the bpdm_login shortcode and inspect attribute values for HTML or script syntax.
- Review contributor submissions in the moderation queue before publication, focusing on shortcode attributes.
- Enable a Content Security Policy (CSP) in report-only mode to surface inline script execution on rendered pages.
Monitoring Recommendations
- Log and alert on shortcode content changes made by non-editor accounts.
- Monitor WordPress audit logs for role changes, plugin installations, and option modifications following page views by privileged users.
- Track browser telemetry for anomalous script execution on pages that render the affected shortcode.
How to Mitigate CVE-2025-10189
Immediate Actions Required
- Deactivate the BP Direct Menus plugin until a patched release is confirmed to be installed.
- Audit all posts and pages for the bpdm_login shortcode and remove or sanitize any suspicious attribute values.
- Restrict contributor-level account creation and review existing low-privilege accounts for legitimacy.
Patch Information
No fixed version is identified in the referenced advisory at the time of publication. Monitor the Wordfence Vulnerability Report and the plugin's WordPress.org listing for an updated release. Apply the patched version as soon as it becomes available.
Workarounds
- Remove the plugin entirely if the bpdm_login shortcode is not required for site functionality.
- Deploy a web application firewall (WAF) rule that blocks shortcode attribute values containing HTML tags or JavaScript event handlers.
- Enforce a strict Content Security Policy that disallows inline scripts to limit exploitation impact.
# Disable the plugin via WP-CLI while awaiting a patch
wp plugin deactivate bp-direct-menus
wp plugin delete bp-direct-menus
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
