The vulnerability CVE-2025-10580 is a stored cross-site scripting (CWE-79) flaw in the marketingfire WordPress plugin 'Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets'. It arises from inadequate sanitization and escaping of user input in multiple functions, allowing authenticated users with Contributor or higher privileges to inject arbitrary web scripts. These scripts execute when any user accesses the injected page, potentially compromising user sessions or data. The issue affects all plugin versions up to 4.1.2. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with scope change. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An authenticated attacker with Contributor-level or higher privileges can inject malicious scripts into pages via the plugin, leading to stored cross-site scripting attacks. This can result in unauthorized actions performed in the context of other users viewing the affected pages, potentially compromising confidentiality and integrity of user data. Availability is not impacted. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Contributor-level access to trusted users only and consider disabling or removing the affected plugin to prevent exploitation.