Cross-site Scripting Vulnerability in Simple Google Static Map by Ángel C.
CVE-2025-27334

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Simple Google Static Map
Vendor
CVE Published:
6 June 2025

What is CVE-2025-27334?

The Simple Google Static Map plugin, developed by Ángel C., has a vulnerability that allows for DOM-Based Cross-site Scripting (XSS). This issue arises from improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts into web pages viewed by users. The vulnerability affects versions from n/a up to 1.0.1, posing a risk to sites utilizing this plugin. Website administrators are urged to review their installations and apply necessary updates to mitigate this security risk.

Affected Version(s)

Simple Google Static Map <= 1.0.1

References

https://patchstack.com/database/wordpress/plugin/simple-g...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chu The Anh (Blue Rock) (Patchstack Alliance)
.
CVE-2025-27334 : Cross-site Scripting Vulnerability in Simple Google Static Map by Ángel C.