Stored XSS Vulnerability in Simple Nested Menu by Mostafa Shahiri
CVE-2025-49442

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Simple Nested Menu
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49442?

A vulnerability in the Simple Nested Menu plugin by Mostafa Shahiri allows for Stored XSS attacks due to improper input handling during web page generation. This vulnerability affects versions from n/a through 1.0, enabling attackers to inject malicious scripts that can be executed in the context of users visiting affected pages. Ensuring the application processes inputs correctly and sanitizes data can help mitigate these risks.

Affected Version(s)

Simple Nested Menu <= 1.0

References

https://patchstack.com/database/wordpress/plugin/simple-n...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chu The Anh (Blue Rock) (Patchstack Alliance)
JSON
.
CVE-2025-49442 : Stored XSS Vulnerability in Simple Nested Menu by Mostafa Shahiri