CVE-2025-13071
Custom Admin Menu <= 1.0.0 - Reflected XSS
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
14th
The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
| Vendor | unknown |
| Product | custom admin menu |
| Published | Dec 9, 2025 |
| Last Updated | Apr 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown custom admin menu
Be the first to know when new high vulnerabilities affecting unknown custom admin menu are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Custom Admin Menu
0 ≤ 1.0.0
References
Credits
Yousof Nahya WPScan