CVE-2025-10180 is a stored cross-site scripting vulnerability in the jhoppe Markdown Shortcode WordPress plugin (up to version 0.2.1). The issue stems from improper neutralization of input during web page generation (CWE-79), specifically due to insufficient sanitization and escaping of user-supplied attributes in the 'markdown' shortcode. This allows authenticated users with contributor-level privileges or higher to inject malicious scripts that persist and execute in the context of other users viewing the injected content. The vulnerability is network exploitable with low attack complexity and no user interaction required beyond authentication. The CVSS 3.1 base score is 6.4, reflecting limited confidentiality and integrity impact but no availability impact. No patch or official remediation has been published as of the data provided.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the affected pages, potentially leading to unauthorized actions or data exposure within the context of the WordPress site. The impact is limited to confidentiality and integrity, with no direct availability impact. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's communications for updates and consider restricting contributor-level access until a fix is released. Applying strict input validation or disabling the vulnerable shortcode may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.