Stored Cross-Site Scripting in Easy Restaurant Menu Manager for WordPress

CVE-2025-6673

What is CVE-2025-6673?

The Easy Restaurant Menu Manager plugin for WordPress is susceptible to Stored Cross-Site Scripting vulnerabilities through its nsc_eprm_menu_link shortcode. This flaw arises from inadequate input sanitization and output escaping of user-supplied attributes, enabling authenticated users with contributor-level access or higher to inject malicious JavaScript into webpages. As a result, arbitrary scripts may execute in the context of users accessing the compromised pages, leading to potential security breaches.

References