What is the CVSS score of CVE-2025-15345?

CVE-2025-15345 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

MapGeo WordPress Plugin CVE-2025-15345

EUVD-2025-209837 MEDIUM

Basic XSS (CWE-80)

2026-05-14 security@wordfence.com

GHSA-j6mj-c34v-f82j

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:53 vuln.today

CVE Published

May 14, 2026 - 06:16 nvd

MEDIUM 6.1

DescriptionCVE.org

The MapGeo - Interactive Geo Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'map' parameter in the display-map shortcode in all versions up to, and including, 1.6.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in the MapGeo - Interactive Geo Maps WordPress plugin (all versions through 1.6.27) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized 'map' parameter of the display-map shortcode. Exploitation requires tricking an authenticated or anonymous site visitor into clicking a crafted URL, after which the injected script executes in the victim's browser within the plugin's page scope. No public exploit code or CISA KEV listing exists at time of analysis; EPSS probability is 0.06%, placing this in the 19th percentile of exploitation likelihood.

Technical ContextAI

The vulnerability is rooted in CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page), a subclass of reflected XSS where user-supplied input is echoed back into HTML output without adequate sanitization or contextual output escaping. The affected component is the display-map shortcode handler in the WordPress plugin, specifically the 'map' parameter processed in src/Plugin/Map.php. The WordPress shortcode API passes URL or post query parameters directly to the handler, and without wp_kses, esc_attr, or esc_html escaping applied before rendering into the DOM, an attacker can inject script payloads. The CVSS scope is Changed (S:C), indicating that the injected script executes in the context of the victim's browser session rather than being contained to the server, consistent with classic reflected XSS behavior. Affected CPE is the MapGeo - Interactive Geo Maps plugin for WordPress, versions 0 through 1.6.27 inclusive.

RemediationAI

Update the MapGeo - Interactive Geo Maps plugin to version 1.6.28 or later. The vendor-released patch is confirmed via the WordPress Plugin Trac changeset at https://plugins.trac.wordpress.org/changeset?old_path=/interactive-geo-maps/tags/1.6.27/src/Plugin/Map.php&new_path=/interactive-geo-maps/tags/1.6.28/src/Plugin/Map.php, which shows the specific fix applied to Map.php. Additional details are available via the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bfccbf41-c861-4bf1-b400-7858cb255b9a. If immediate upgrade is not possible, a compensating control is to remove or disable any page or post using the display-map shortcode, which eliminates the attack surface entirely at the cost of losing map display functionality. Web application firewall rules blocking reflected XSS patterns in query parameters can also reduce risk, though this is not a substitute for patching.