CVE-2025-9493 is a stored cross-site scripting vulnerability in the whiteshadow Admin Menu Editor WordPress plugin, affecting all versions up to and including 1.14. The flaw exists because the plugin does not properly sanitize or escape the 'placeholder' parameter, allowing authenticated users with Author-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of other users viewing the injected pages, potentially leading to information disclosure or integrity issues. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges at the Author level, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with Author-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to partial confidentiality and integrity breaches, such as theft of session tokens or manipulation of page content. There is no direct impact on system availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates. Until a patch is released, restrict Author-level access to trusted users only and consider disabling or limiting use of the Admin Menu Editor plugin to reduce exposure.