PT-2025-38803 · 100Plugins · Open User Map

Abu Hurayra · Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-57953

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions 100plugins Open User Map versions through 1.4.14

Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a DOM-Based Cross-site Scripting issue. This allows for the execution of malicious scripts within the context of the affected web page. The vulnerability exists because the application does not adequately sanitize user-supplied data before incorporating it into the generated web page. This can potentially allow an attacker to inject arbitrary HTML or JavaScript code into the page, which could then be executed by other users who view the page.

Recommendations Update 100plugins Open User Map to a version later than 1.4.14.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-57953

Affected Products

Open User Map

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-57953 · Security Note
• https://twitter.com/CVEnew/status/1970208050024972551 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/open-user-map/vulnerability/wordpress-open-user-map-plugin-1-4-14-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/open-user-map/vulnerability/wordpress-open-user-map-plugin-1-4-14-cross-site-scripting-xss-vulnerability?_s_id=cve · Note