CVE-2025-10132 is a stored cross-site scripting vulnerability in the dash8x Dhivehi Text WordPress plugin, affecting all versions up to and including 0.1. The vulnerability is due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'dhivehi' shortcode. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial confidentiality and integrity impact with no availability impact.

An attacker with contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into WordPress pages using the vulnerable shortcode. This can lead to partial compromise of confidentiality and integrity of user data viewed on affected pages. There is no direct impact on system availability. The vulnerability requires authenticated access, limiting the attack surface to users with elevated privileges.

No official patch or fix is currently available for this vulnerability. Since the plugin is not a cloud service, remediation depends on the vendor releasing an update. Until a fix is provided, administrators should restrict contributor-level access and above to trusted users only and consider disabling or removing the Dhivehi Text plugin if possible. Monitor the vendor's advisory channels for updates and apply patches promptly once released.