CVE-2025-11307: WP Google Maps < 9.0.48 - Unauthenticated Stored XSS
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11307?
CVE-2025-11307 is classified as a high severity vulnerability due to the potential for unauthenticated users to execute stored XSS attacks.
How do I fix CVE-2025-11307?
To fix CVE-2025-11307, update the WP Go Maps plugin to version 9.0.48 or later.
Who is affected by CVE-2025-11307?
CVE-2025-11307 affects all versions of the WP Go Maps plugin prior to 9.0.48.
What type of vulnerability is CVE-2025-11307?
CVE-2025-11307 is a Cross-Site Scripting (XSS) vulnerability that allows persistence of malicious scripts.
Can CVE-2025-11307 be exploited remotely?
Yes, CVE-2025-11307 can be exploited remotely by unauthenticated users through crafted AJAX requests.