CVE-2025-10179 is a stored cross-site scripting vulnerability in the My AskAI WordPress plugin (versions up to 1.0.0). The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of user-supplied attributes in the 'myaskai' shortcode. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with scope changed.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the affected pages, potentially leading to unauthorized actions or data disclosure limited to the confidentiality and integrity impacts described. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should consider restricting contributor-level access until a fix is available or apply manual mitigations such as disabling the vulnerable shortcode if feasible. Monitor the vendor's channels for updates and apply official patches promptly once released.