PeproDev Branches Map EUVD-2025-211087

Requires an authenticated WordPress account with Contributor-level privileges or higher on a site running the PeproDev Branches Map (Mapify) plugin version 3.0.1 or earlier; the attacker injects a script payload into plugin-handled page/map content that is stored without sanitization or output escaping. Exploitation is limited by that authentication requirement (PR:L - self-registration or loosely granted authoring accounts broaden exposure) and by the need for a separate victim (admin or visitor) to subsequently view the injected page for the stored payload to fire. No special non-default plugin configuration is indicated in the description beyond having the vulnerable plugin installed and active.

This is a moderate-severity stored XSS (CWE-79) with a CVSS 3.1 base score of 6.4 and vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The network attack vector and low complexity are offset by a key limiting factor: PR:L means the attacker must already hold a Contributor-level (or higher) authenticated account, which substantially narrows the realistic attacker population to users who have been granted content-authoring privileges on the WordPress site. Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no POC referenced in the provided data, and no EPSS score was supplied, so widespread automated exploitation cannot be inferred. The scope change (S:C) reflects that injected scripts execute in the browser context of other users viewing the page, enabling session/credential theft or privilege escalation against higher-privileged viewers (e.g., administrators), which is the main reason this exceeds a trivial self-XSS. Net assessment: this is a real but authenticated, lower-tier priority - important for multi-author WordPress sites where Contributor accounts are loosely granted or self-registration is enabled, but not a drop-everything internet-facing unauthenticated RCE. Missing signals (EPSS, POC status) are noted rather than assumed; the fact that the fix landed quietly in changeset 3.0.2 and was reported by Wordfence suggests responsible disclosure rather than observed in-the-wild abuse.

An attacker who holds or obtains a Contributor-level account on a WordPress site running PeproDev Branches Map (Mapify) ≤3.0.1 submits a page or map entry containing a malicious script payload that is stored without proper sanitization. When an administrator or other visitor later views that page, the script executes in their browser, enabling session hijacking, admin-action forgery, or further privilege escalation. No public exploit code is referenced in the available data, and the network vector with low complexity means no special tooling is required once an account is held.