EUVD-2025-209491
GHSA-9726-56v6-8wh4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The WP Maps - Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'put_wpgm' shortcode in all versions up to, and including, 4.8.7. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored XSS in WP Maps plugin for WordPress allows authenticated contributors to inject malicious scripts via the 'put_wpgm' shortcode due to insufficient input sanitization and output escaping. Attackers with contributor-level access and above can craft malicious shortcode attributes that persist in page content and execute for all subsequent visitors. All versions up to 4.8.7 are affected; patched version 4.8.8 is available.
Technical ContextAI
The vulnerability resides in the WP Maps - Store Locator plugin's handling of the 'put_wpgm' shortcode, a WordPress feature that allows administrators and contributors to embed dynamic content via square-bracket syntax. The plugin fails to properly sanitize user-supplied shortcode attributes before storing them in the database and fails to escape the output when rendering the shortcode on the front-end. This violates WordPress security best practices for both sanitization (cleaning input at entry) and escaping (cleaning output at display). CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause; the plugin does not filter or validate attribute values that could contain HTML/JavaScript payloads. The attack vector is network-based because WordPress shortcodes are processed server-side but the injection occurs through the web interface, and authentication is required (PR:L, contributor level minimum). The scope is changed (S:C) because stored XSS affects all site visitors, not just the attacker.
RemediationAI
Immediately upgrade the WP Maps plugin to version 4.8.8 or later, which patches the input sanitization and output escaping flaws in the 'put_wpgm' shortcode handler. Update via WordPress Admin Dashboard (Plugins > Installed Plugins > WP Maps > Update) or download from https://plugins.trac.wordpress.org/changeset?old_path=wp-google-map-plugin/tags/4.8.7/wp-google-map-plugin.php&new_path=wp-google-map-plugin/tags/4.8.8/wp-google-map-plugin.php. While waiting for the update, audit all published pages and posts containing the 'put_wpgm' shortcode to ensure no malicious attributes are present; use WordPress Search & Replace plugins if needed to quickly identify affected content. Restrict contributor-level access to only trusted users and consider temporarily revoking the ability to edit pages/posts containing this shortcode until the patch is deployed. Monitor site traffic and log files for evidence of XSS payload injection or execution (search for unusual script tags or event handlers in page content). These workarounds have limited effectiveness and are not substitutes for patching; the primary mitigation is upgrading to 4.8.8 immediately.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today