PT-2025-46300 · WordPress · Wp Go Maps+1

Sunghoon Kim · Published 2025-11-11 · Updated 2025-12-04 · CVE-2025-11307

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Go Maps (formerly WP Google Maps) versions prior to 9.0.48

Description The WP Go Maps WordPress plugin does not properly sanitize user-supplied data submitted through an AJAX request. This allows unauthenticated users to inject and store cross-site scripting (XSS) payloads. These payloads are subsequently retrieved via another AJAX call and displayed without proper escaping, potentially leading to the execution of malicious scripts. The plugin is vulnerable because it fails to validate input before processing it, creating an opportunity for attackers to compromise the system.

Recommendations Update WP Go Maps (formerly WP Google Maps) to version 9.0.48 or later.

Exploit

Fix

Related Identifiers

CVE-2025-11307

Affected Products

Wp Go Maps

Wp Google Maps

References · 7

• 🔥 https://wpscan.com/vulnerability/f5b21a05-7a51-4530-9e07-4700f00eeca3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11307 · Security Note
• https://t.me/CVEtracker/37003 · Telegram Post
• https://twitter.com/CVEnew/status/1988130556127965597 · Twitter Post
• https://t.me/cveNotify/142615 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1996504782820053456 · Twitter Post
• https://t.me/cveNotify/142377 · Telegram Post