Stored Cross-Site Scripting Vulnerability in LS Google Map Router Plugin for WordPress

CVE-2025-13850

What is CVE-2025-13850?

The LS Google Map Router plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) via the 'map_type' parameter across all versions prior to 1.1.0. Insufficient input sanitization and output escaping allow authenticated users, with Contributor-level access or higher, to insert harmful web scripts. These scripts will execute whenever a page containing the injected code is accessed, posing significant risks to site security and user data integrity. This vulnerability highlights the importance of proper validation and sanitation of user inputs to prevent such attacks.

References