CVE-2025-6572: OpenStreetMap for Gutenberg and WPBakery Page Builder <= 1.2.0 - Contributor+ Stored XSS
The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6572?
CVE-2025-6572 has a medium severity rating due to its potential to allow unauthorized access to sensitive information.
How do I fix CVE-2025-6572?
To fix CVE-2025-6572, update the OpenStreetMap for Gutenberg and WPBakery Page Builder plugins to version 1.2.1 or later.
Who is affected by CVE-2025-6572?
CVE-2025-6572 affects users of the OpenStreetMap for Gutenberg and WPBakery Page Builder plugins up to version 1.2.0.
What type of vulnerability is CVE-2025-6572?
CVE-2025-6572 is a cross-site scripting (XSS) vulnerability that results from insufficient validation and escaping of user inputs.
What could happen if CVE-2025-6572 is exploited?
If exploited, CVE-2025-6572 could allow contributors to execute arbitrary JavaScript code in the context of users accessing the affected page or post.