Stored Cross-Site Scripting in CBX Map for Google Map & OpenStreetMap Plugin by WordPress

CVE-2025-9123

What is CVE-2025-9123?

The CBX Map for Google Map & OpenStreetMap plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping in the popup heading and location address parameters. This vulnerability allows authenticated users with Contributor-level access or higher to inject malicious web scripts into pages, which can be executed by unsuspecting visitors when they view those pages. This poses a significant security risk, highlighting the importance of keeping plugins updated and practicing diligent security measures.

References