CVE-2025-14888
Stored XSS in Simple User Meta Editor Plugin for WordPress
Publication date: 2026-01-07
Last updated on: 2026-01-07
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| simple_user_meta_editor | plugin | to 1.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Simple User Meta Editor plugin for WordPress (up to version 1.0.0). It occurs because the plugin does not properly sanitize or escape user meta value inputs. An authenticated attacker with administrator-level access can inject malicious scripts into user meta fields. These scripts execute whenever a user accesses the affected page. This vulnerability only affects multi-site WordPress installations or those where the unfiltered_html setting is disabled.
How can this vulnerability impact me? :
The vulnerability allows an attacker with admin access to inject malicious scripts that execute in the context of users visiting the infected pages. This can lead to unauthorized actions, data theft, session hijacking, or other malicious activities performed on behalf of users without their consent. Since it requires administrator-level access and affects multi-site or restricted HTML installations, the impact is limited but can still compromise site integrity and user security.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that you are not using versions of the Simple User Meta Editor plugin up to and including 1.0.0. Update the plugin to a version where this vulnerability is fixed. Additionally, restrict administrator-level access to trusted users only, and consider enabling unfiltered_html if possible, or avoid multi-site installations where this plugin is used. Implementing strict input sanitization and output escaping in custom code can also help reduce risk.