Stored Cross-Site Scripting Vulnerability in Mihdan: Elementor Yandex Maps for WordPress

CVE-2025-8608

What is CVE-2025-8608?

The Mihdan: Elementor Yandex Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping within the plugin's block attributes. This flaw allows authenticated users with contributor-level access and above to inject arbitrary scripts into web pages. Such scripts execute whenever a user accesses the infected page, potentially leading to data theft, session hijacking, or other malicious activities.

References