Stored Cross-Site Scripting in Admin Menu Editor Plugin for WordPress

CVE-2025-9493

What is CVE-2025-9493?

The Admin Menu Editor plugin for WordPress is susceptible to Stored Cross-Site Scripting due to a lack of proper input sanitization and output escaping in the 'placeholder' parameter. This vulnerability allows authenticated attackers, with an Author-level access or higher, to inject malicious web scripts into pages. These scripts execute whenever other users access an affected page, posing a significant risk to site integrity and user safety. It is crucial for users of the plugin to update to the latest version to mitigate this threat.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References