CVE-2025-10135 is a stored cross-site scripting vulnerability in the falldeaf WP ViewSTL WordPress plugin, affecting all versions up to and including 1.0. The issue stems from improper neutralization of input during web page generation, specifically in the 'viewstl' shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated users with contributor-level privileges or higher to inject malicious scripts that execute in the context of other users viewing the compromised pages. The vulnerability has a CVSS 3.1 score of 6.4, reflecting its medium impact on confidentiality and integrity without affecting availability.

Successful exploitation allows authenticated contributors or higher to inject persistent scripts into pages via the 'viewstl' shortcode. These scripts execute in the browsers of users who view the infected pages, potentially leading to unauthorized actions or data disclosure limited to the privileges of the victim user. The vulnerability does not impact availability and requires authenticated access, reducing its overall risk but still posing a threat to site integrity and user trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the WP ViewSTL plugin if possible. Monitor for updates from the falldeaf project regarding patches or security advisories.