This vulnerability arises from insufficient input sanitization and output escaping of the ‘placeholder’ parameter in the Admin Menu Editor plugin. An attacker who has authenticated access as an Author or higher can inject arbitrary JavaScript that is stored and subsequently rendered in pages that include the impacted menu item. The stored payload executes whenever any site visitor loads the affected page, potentially allowing the attacker to steal credentials, hijack sessions, or deface content.

The flaw exists in all versions of the Admin Menu Editor plugin for WordPress supplied by whiteshadow up to and including version 1.14. Newer releases are not indicated as affected.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of active exploitation at the time of the assessment. The vulnerability is not currently listed in the CISA KEV catalog. Attackers require authenticated access at the Contributor level or higher and must submit a payload via the placeholder field; once stored, the script runs in the context of any user who views the affected page. The exposed impact lies primarily in confidentiality and integrity of user sessions and the site’s UI.