TLDRVuln - Cybersecurity Vulnerabilities Made Simple

CVE-2025-10636

Low · published October 30, 2025

CVSS v3.1

3.5

EPSS

Percentile

7.3

In the wild

Unconfirmed

What it is

The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

The record

Technical detail

CVSS v3.1: 3.5 · LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00181 · 7.3th percentile
Published: 2025-10-30T10:15Z

References (1)

https://wpscan.com/vulnerability/a1ab1d82-108e-4f66-9d06-5036cde9678a/ · [email protected]

EPSS history

Timeline

30 OCT 06:00Z
NS Maintenance Mode for WP <= 1.3.1 - Admin+ Stored XSS
cvelistv5