Stored Cross-Site Scripting Vulnerability in Mapster WP Maps Plugin for WordPress

CVE-2025-9044

What is CVE-2025-9044?

The Mapster WP Maps plugin for WordPress exhibits a vulnerability that permits Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This flaw is present in all versions up to 1.20.0, enabling attackers with contributor-level permissions and above to embed arbitrary web scripts in pages. These scripts become active whenever a user visits an affected page, potentially leading to unauthorized activities or data exposure.

References