Cross-Site Scripting Vulnerabilities in WP Go Maps Plugin by WordPress
CVE-2025-11307
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 11 November 2025
Badges
What is CVE-2025-11307?
The WP Go Maps plugin, previously known as WP Google Maps, has a critical vulnerability that allows unauthenticated users to inject malicious JavaScript payloads. This is due to the plugin's failure to properly sanitize user input received through AJAX actions. Consequently, these payloads can be stored and later retrieved via another AJAX call, posing significant risks as the unsanitized data is output directly, thus enabling XSS attacks. Users of this plugin should update to version 9.0.48 or later to mitigate this risk.
Affected Version(s)
WP Go Maps (formerly WP Google Maps) 0 < 9.0.48
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.