Stored Cross-Site Scripting in Admin Menu Editor Plugin for WordPress

CVE-2025-9493

What is CVE-2025-9493?

The Admin Menu Editor plugin for WordPress is susceptible to Stored Cross-Site Scripting due to a lack of proper input sanitization and output escaping in the 'placeholder' parameter. This vulnerability allows authenticated attackers, with an Author-level access or higher, to inject malicious web scripts into pages. These scripts execute whenever other users access an affected page, posing a significant risk to site integrity and user safety. It is crucial for users of the plugin to update to the latest version to mitigate this threat.

References