Stored Cross-Site Scripting in Responsive iframe GoogleMap Plugin for WordPress

CVE-2025-11813

What is CVE-2025-11813?

The Responsive iframe GoogleMap plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'responsive_map' shortcode. This vulnerability arises from inadequate input sanitization and output escaping for the 'width' and 'height' attributes in all versions up to and including 1.0.2. Authenticated users with contributor-level permissions or higher can exploit this flaw to inject malicious web scripts into pages, resulting in the execution of these scripts whenever other users access the compromised pages.

References