CVE-2025-8622
BaseFortify
Publication date: 2025-08-19
Last updated on: 2025-08-19
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | wp_flexible_map | 1.18.0 |
| wordpress | wp_flexible_map | 1.19.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-8622 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Flexible Map (versions up to 1.18.0). It occurs because the plugin does not properly sanitize and escape user-supplied attributes in its Flexible Maps shortcode. This allows authenticated users with contributor-level access or higher to inject malicious scripts into pages. These scripts execute whenever any user views the affected page, potentially compromising site security. [1, 3]
How can this vulnerability impact me? :
This vulnerability can allow authenticated attackers to inject arbitrary malicious scripts into web pages via the Flexible Map plugin. When other users access these pages, the injected scripts execute in their browsers, potentially leading to theft of sensitive information, session hijacking, defacement, or other malicious actions. This compromises the security and integrity of the affected WordPress site. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the WordPress site is running the Flexible Map plugin version 1.18.0 or earlier, as these versions are vulnerable to stored Cross-Site Scripting (XSS). You can detect the plugin version by using WP-CLI commands such as `wp plugin list` to see installed plugins and their versions. Additionally, reviewing pages or posts that use the Flexible Maps shortcode for suspicious or unexpected script injections may help identify exploitation attempts. There are no specific network commands provided for detection in the resources. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the Flexible Map plugin to version 1.19.0 or later, where the vulnerability has been fixed by properly sanitizing and escaping user inputs to prevent XSS attacks. Until the update is applied, restrict contributor-level and higher user access to trusted users only, as the vulnerability requires authenticated access. Monitoring and removing any suspicious injected scripts from pages is also advisable. [1, 2, 3]