CVE-2025-9493

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9493", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-26T17:32:55.400Z", "datePublished": "2025-09-06T03:22:36.504Z", "dateUpdated": "2026-04-08T16:58:43.156Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:43.156Z"}, "affected": [{"vendor": "whiteshadow", "product": "Admin Menu Editor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Admin Menu Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018placeholder\u2019 parameter in all versions up to, and including, 1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Admin Menu Editor <= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/69b9d4e1-895b-4199-bc4e-489afd9d36eb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-menu-editor/tags/1.14/includes/shortcodes.php#L42"}, {"url": "https://wordpress.org/plugins/admin-menu-editor/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3353790%40admin-menu-editor&old=3329611%40admin-menu-editor&sfp_email=&sfph_mail=#file857"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-08-27T20:24:18.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-05T15:11:45.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-08T20:18:54.178244Z", "id": "CVE-2025-9493", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T20:19:00.981Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-08T20:18:54.178244Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T20:18:58.309Z"}}], "cna": {"title": "Admin Menu Editor <= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "whiteshadow", "product": "Admin Menu Editor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.14"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-27T20:24:18.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-05T15:11:45.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/69b9d4e1-895b-4199-bc4e-489afd9d36eb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-menu-editor/tags/1.14/includes/shortcodes.php#L42"}, {"url": "https://wordpress.org/plugins/admin-menu-editor/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3353790%40admin-menu-editor&old=3329611%40admin-menu-editor&sfp_email=&sfph_mail=#file857"}], "descriptions": [{"lang": "en", "value": "The Admin Menu Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018placeholder\u2019 parameter in all versions up to, and including, 1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:43.156Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9493", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:58:43.156Z", "dateReserved": "2025-08-26T17:32:55.400Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-06T03:22:36.504Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Admin Menu Editor", "vendor": "whiteshadow", "versions": [{"lessThanOrEqual": "1.14", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Admin Menu Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018placeholder\u2019 parameter in all versions up to, and including, 1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-9493", "lastModified": "2026-06-17T10:09:06.370", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9493", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-08T20:18:54.178244Z", "version": "2.0.3"}}]}, "published": "2025-09-06T04:16:08.990", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/admin-menu-editor/tags/1.14/includes/shortcodes.php#L42"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3353790%40admin-menu-editor&old=3329611%40admin-menu-editor&sfp_email=&sfph_mail=#file857"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/admin-menu-editor/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/69b9d4e1-895b-4199-bc4e-489afd9d36eb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:12:49.659289+00:00", "value": {"mitigation_remediation": ["Update the Admin Menu Editor plugin to the latest released version that removes the placeholder vulnerability", "Review and clean any existing menu items that include custom placeholder values containing user\u2011supplied content; delete or replace them", "Enforce stricter role\u2011based access controls by limiting Contributor or Author permissions when the plugin is in use, or consider disabling the plugin if advanced menu editing is not required"], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting allowed for authenticated users with Contributor level or higher in WordPress"}, "threat_synthesis": {"affected_systems": "The flaw exists in all versions of the Admin Menu Editor plugin for WordPress supplied by whiteshadow up to and including version 1.14. Newer releases are not indicated as affected.", "description_and_impact": "This vulnerability arises from insufficient input sanitization and output escaping of the \u2018placeholder\u2019 parameter in the Admin Menu Editor plugin. An attacker who has authenticated access as an Author or higher can inject arbitrary JavaScript that is stored and subsequently rendered in pages that include the impacted menu item. The stored payload executes whenever any site visitor loads the affected page, potentially allowing the attacker to steal credentials, hijack sessions, or deface content.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of active exploitation at the time of the assessment. The vulnerability is not currently listed in the CISA KEV catalog. Attackers require authenticated access at the Contributor level or higher and must submit a payload via the placeholder field; once stored, the script runs in the context of any user who views the affected page. The exposed impact lies primarily in confidentiality and integrity of user sessions and the site\u2019s UI."}}}}, "created": "2025-09-09T21:32:07.437900+00:00", "updated": "2026-04-21T03:15:16.337404+00:00", "vendors": ["w-shadow", "w-shadow$PRODUCT$admin_menu_editor", "wordpress", "wordpress$PRODUCT$wordpress"]}