Cross-Site Scripting Vulnerability in Maps for WP by WordPress
CVE-2025-32179
6.5MEDIUM
Summary
The Maps for WP plugin for WordPress is susceptible to a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This flaw allows attackers to inject malicious scripts, which can then be executed in the context of users viewing affected pages, potentially leading to unauthorized actions or data theft. The issue impacts all versions of Maps for WP up to 1.2.4, necessitating immediate attention to mitigate risks associated with this vulnerability.
Affected Version(s)
Maps for WP <= 1.2.4
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
zaim (Patchstack Alliance)