AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
← CVE index

Attributed metadata history

Δ / VULNERABILITY RECORD

CVE-2025-10191.

Source-reported disclosure and enrichment record.

SEVERITY / CVSSMEDIUM / 6.4CVSS 3.1 · security@wordfence.com
EXPLOITATION STATUSNo cached KEV assertionThe local KEV cache may be unavailable or incomplete; this does not establish absence of exploitation.
RECORD STATUSDeferredModified Oct 09, 2026

Disclosure summary

The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpost_shipping_status' shortcode in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Source-reported weakness categories

CWE-79

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

NIST NVD · NVD-CVE-2025-10191

Open original source · Updated Oct 09, 2026

Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.

NIST NVD · nvd:CVE-2025-10191

Open original source · Updated Oct 09, 2026

The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpost_shipping_status' shortcode in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Source severity: MEDIUM / 6.4

Original records & references

GitHub repository matches

Repository matches are links and GitHub-supplied metadata only. They are not verified working proof-of-concept code. Each supported query is bounded to ten pages and at most 1,000 indexed results. This is not a complete index of GitHub or public exploit research. Coverage can also be limited by provider availability, rate limits, rejected metadata, incomplete search results, manual review, and the recorded refresh time.

0 reviewed associations0 unverified candidates

No stored repository matches

Repository discovery has not recorded an update for this CVE yet.

Discovery progress

0 of 3 discovery queries finished. GitHub returned 0 indexed results; 0 malformed or disallowed results were rejected.

No discovery update has been recorded for this CVE.

View all 0 stored repository matches

PUBLISHED 2025-09-30T11:37:38+00:00
MODIFIED 2026-10-09T09:10:00+00:00
INGESTED 2026-10-12T09:36:03+00:00