CVE-2025-11307
BaseFortify
Publication date: 2025-11-11
Last updated on: 2025-11-13
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wp_google_maps | wp_google_maps | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WP Go Maps WordPress plugin before version 9.0.48 has a vulnerability where it does not properly sanitize user input provided via an AJAX action. This allows unauthenticated users to store cross-site scripting (XSS) payloads, which are later retrieved and output without escaping through another AJAX call.
How can this vulnerability impact me? :
This vulnerability can allow attackers to inject malicious scripts into the website, which can be executed in the browsers of users who access the affected AJAX responses. This can lead to theft of user credentials, session hijacking, defacement, or distribution of malware.