CVE-2025-5194: WP Map Block by aBlocks < 2.0.3 - Contributor+ Stored XSS via Marker
Published Jun 27, 2025
·Updated
The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Software
2 affected components
aBlocks WP Map Block<2.0.3
Wp Map Block Project Wp Map Block Wordpress<2.0.3
Event History
Jun 27, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-5194?
CVE-2025-5194 has a medium severity rating due to the potential for Stored Cross-Site Scripting attacks.
2
How do I fix CVE-2025-5194?
To fix CVE-2025-5194, update the WP Map Block plugin to version 2.0.3 or later.
3
Who is affected by CVE-2025-5194?
Users with the contributor role and above in WordPress are affected by CVE-2025-5194.
4
What type of attack does CVE-2025-5194 enable?
CVE-2025-5194 enables Stored Cross-Site Scripting (XSS) attacks.
5
What software is impacted by CVE-2025-5194?
CVE-2025-5194 impacts versions of the WP Map Block plugin prior to 2.0.3.