Descripción
The Admin Menu Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder’ parameter in all versions up to, and including, 1.14 due insufficient input sanitization output escaping. This makes it possible authenticated attackers, with Author-level access above, inject arbitrary web scripts pages that will execute whenever a user accesses an injected page.
https://plugins.trac.wordpress.org/browser/admin-menu-editor/tags/1.14/includes/shortcodes.php#L42
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3353790 40admin-menu-editor&old=3329611 40admin-menu-editor&sfp_email=&sfph_mail=#file857
https://wordpress.org/plugins/admin-menu-editor/
https://www.wordfence.com/threat-intel/vulnerabilities/id/69b9d4e1-895b-4199-bc4e-489afd9d36eb?source=cve
