Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in atelierhyper AuMenu aumenu allows Reflected XSS.This issue affects AuMenu: from n/a through <= 1.1.5.
Published: 2025-03-26
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper neutralization of user input during web page generation allows an attacker to inject JavaScript that is reflected back to the victim’s browser. This reflected cross‑site scripting (XSS) can lead to session hijacking, data theft, or defacement. The weakness is identified as CWE‑79.

Affected Systems

The vulnerability exists in the AuMenu plugin developed by atelierhyper. Versions up to and including 1.1.5 are affected. Sites running any of these versions without an update are susceptible.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity, while the EPSS score of < 1% shows that exploitation likelihood is low at this time. It is not listed in CISA’s KEV catalog, and the attack vector is web‑based and requires the victim to visit a crafted URL. Because the page simply reflects untrusted input, an attacker can freely construct scripts to run in the victim’s browser.

Generated by OpenCVE AI on May 1, 2026 at 13:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the AuMenu plugin to the latest release that fixes the XSS issue.
  • If an immediate update is not possible, disable the AuMenu plugin or remove its front‑end functionality until a patch is applied.
  • Review the plugin’s input handling and ensure that all user‑supplied data is passed through WordPress’s wp_kses or sanitize_text_field functions to prevent reflected XSS.

Generated by OpenCVE AI on May 1, 2026 at 13:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-8185 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound AuMenu allows Reflected XSS. This issue affects AuMenu: from n/a through 1.1.5.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound AuMenu allows Reflected XSS. This issue affects AuMenu: from n/a through 1.1.5. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in atelierhyper AuMenu aumenu allows Reflected XSS.This issue affects AuMenu: from n/a through <= 1.1.5.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 26 Mar 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 26 Mar 2025 14:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound AuMenu allows Reflected XSS. This issue affects AuMenu: from n/a through 1.1.5.
Title WordPress AuMenu plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-05-11T23:55:17.024Z

Reserved: 2025-01-16T11:28:53.181Z

Link: CVE-2025-23728

cve-icon Vulnrichment

Updated: 2025-03-26T15:33:07.315Z

cve-icon NVD

Status : Deferred

Published: 2025-03-26T15:16:04.433

Modified: 2026-06-17T08:56:43.947

Link: CVE-2025-23728

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T13:30:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')