The Simple User Meta Editor plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with administrator privileges can inject arbitrary scripts via the user meta value field. This vulnerability specifically affects multi-site WordPress setups or installations where the unfiltered_html capability is disabled, allowing persistent script injection that executes when the injected page is viewed. The CVSS 3.1 base score is 4.4, reflecting a network attack vector, high attack complexity, required privileges at the administrator level, no user interaction, and partial impact on confidentiality and integrity but no impact on availability.

An attacker with administrator-level access on affected WordPress installations can inject malicious scripts that execute in the context of users viewing the compromised pages. This can lead to partial disclosure of confidential information and modification of data accessible to the user. The vulnerability does not impact system availability. The scope is limited to multi-site or unfiltered_html-disabled environments, reducing the overall attack surface.

No official patch or remediation is currently available for this vulnerability. Administrators should monitor the vendor or plugin repository for updates addressing this issue. Until a fix is released, restrict administrator access to trusted users only and consider disabling or removing the Simple User Meta Editor plugin in multi-site or unfiltered_html-disabled environments to prevent exploitation.