CVE-2025-10295 is a stored cross-site scripting vulnerability in the Angel – Fashion Model Agency WordPress CMS Theme affecting all versions up to 3.2.3. The flaw arises from improper neutralization of input in the profile media uploader, allowing authenticated users with subscriber-level privileges or above to inject arbitrary web scripts. These scripts execute in the context of users who view the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability requires the attacker to have access to the profile edit form with media upload functionality. No patch or official fix information is provided in the available data.

This vulnerability allows authenticated users with subscriber-level access or higher to inject and store malicious scripts that execute when other users view the affected pages. This can lead to unauthorized actions performed in the context of the victim's session, such as theft of cookies or other sensitive information. The impact is limited to confidentiality and integrity with no direct availability impact. The CVSS score of 6.4 reflects a medium severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level users from accessing the profile media uploader or disable the media upload feature in the profile edit form if possible. Monitor for suspicious activity related to script injection in user profiles. Avoid granting unnecessary privileges to users who do not require media upload capabilities.