Wp Maps
CVE-2025-3504
MEDIUM
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
AnalysisAI
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Affected products include: Weplugins Wp Maps. Version information: before 4.7.2.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
Local file inclusion via path traversal in WP Maps WordPress plugin (before 4.9.7) allows any authenticated Subscriber-l
Local File Inclusion in the WP Maps WordPress plugin before 4.9.3 allows authenticated users to read arbitrary files by
Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page with
Denial of Service in the WP Maps WordPress plugin before 4.9.7 allows any authenticated subscriber to exhaust server res
Unauthenticated SQL injection in the WP Maps WordPress plugin (versions 4.9.1 and earlier, by Flipper Code) allows remot
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high
Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps - WP MAPS (formerly WP G
Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in
The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the p
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Sensitive data exposure in the WP Maps WordPress plugin (versions through 4.9.6) allows authenticated low-privilege user
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today