CVE-2025-14888 anjan011 CVE debrief

Who should care

Administrators of WordPress installations with the Simple User Meta Editor plugin should assess exposure and verify the plugin version. They should restrict administrator-level access and ensure that unfiltered_html is not disabled.

Why it matters

The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing authenticated attackers with administrator-level access to inject arbitrary web scripts. This affects multi-site installations and installations where unfiltered_html has been disabled. Administrators should verify the plugin version, restrict administrator-level access, and consider upgrading to a patched version when available.

• Authenticated attackers with administrator-level access can inject arbitrary web scripts.
• The vulnerability only affects multi-site installations and installations where unfiltered_html has been disabled.
• Administrators should verify the plugin version and restrict administrator-level access.
• Upgrade to a patched version when available.

Technical summary

The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with administrator-level access to inject arbitrary web scripts. The vulnerability affects multi-site installations and installations where unfiltered_html has been disabled, requiring administrators to verify the plugin version, restrict administrator-level access, and consider upgrading to a patched version when available.

Defensive priority

Administrators of WordPress installations with the Simple User Meta Editor plugin should verify the plugin version and restrict administrator-level access. They should also verify that unfiltered_html is not disabled. If possible, upgrade to a patched version when available.

Recommended defensive actions

• Verify the plugin version and restrict administrator-level access.
• Verify that unfiltered_html is not disabled.
• Consider upgrading to a patched version when available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the Simple User Meta Editor plugin for WordPress. The vulnerability allows for Stored Cross-Site Scripting due to insufficient input sanitization and output escaping.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.