Stored Cross-Site Scripting Vulnerability in Simple User Meta Editor Plugin for WordPress

CVE-2025-14888

What is CVE-2025-14888?

The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting through the user meta value field. This vulnerability affects all versions up to and including version 1.0.0 due to a lack of proper input sanitization and output escaping. Authenticated attackers with administrator-level access can exploit this weakness to inject arbitrary web scripts into pages, leading to potential execution whenever a user visits the compromised page. The risk is particularly significant for multi-site installations and those where unfiltered_html has been disabled.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References