CVE-2025-10636

LowCVSS 3.5/10Last modified Oct 8, 2026

Description

The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Oct 30, 2025
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-106375.3The Social Feed Gallery plugin for WordPress is vulnerable to Information Exposure in versions less than, or equal to, 4.9.2. This is due toCVE-2025-106385.3The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticatedCVE-2025-106398.8The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attCVE-2025-10645.4The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_CVE-2025-106409.8An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks tCVE-2025-106417.1All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker wiCVE-2025-106423.5A vulnerability has been found in wangchenyi1996 chat_forum up to 80bdb92f5b460d36cab36e530a2c618acef5afd2. This impacts an unknown functionCVE-2025-106439.1Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypaCVE-2025-106449.4Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackeCVE-2025-106455.3The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_LiceCVE-2025-106464.3The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient capability check on the BasCVE-2025-106478.8The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_handl
CVE-2025-10636: Low severity, CVSS 3.5 | Vulnix