CVE-2025-10194 describes a stored cross-site scripting vulnerability in the eflyjason Shortcode Button plugin for WordPress. The issue arises from insufficient input sanitization and output escaping of user-supplied attributes within the 'button' shortcode, allowing authenticated attackers with contributor-level access or above to inject arbitrary JavaScript code. This malicious code executes in the context of users visiting the compromised pages, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all versions up to and including 1.1.9. There is no vendor advisory or patch information provided at this time.

Successful exploitation allows authenticated users with contributor or higher privileges to inject persistent malicious scripts into WordPress pages via the shortcode attributes. These scripts execute in the browsers of users who view the infected pages, potentially leading to theft of sensitive information or unauthorized actions performed on behalf of the victim. The vulnerability does not impact availability and requires some level of authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Shortcode Button plugin if possible to prevent exploitation.