CVE-2025-11307
Description
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Unauthenticated stored XSS in WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 via unsanitized AJAX input.
The WP Go Maps (formerly WP Google Maps) WordPress plugin before version 9.0.48 is vulnerable to an unauthenticated stored cross-site scripting (XSS) issue. The plugin fails to sanitize user input supplied via an AJAX action, allowing arbitrary JavaScript payloads to be stored on the server [1].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2<9.0.48+ 1 more
- (no CPE)range: <9.0.48
- (no CPE)range: <9.0.48
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.