Stored Cross-Site Scripting Vulnerability in A Simple Multilanguage Plugin for WordPress

CVE-2025-9854

What is CVE-2025-9854?

The A Simple Multilanguage Plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping of user-supplied attributes in its 'asmp-switcher' shortcode. Attackers with contributor-level access or higher can exploit this vulnerability, allowing them to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses the compromised page, posing significant security risks to both site administrators and users.

References