CVE-2025-23517

Overview

The Google Map on Post/Page plugin for WordPress versions up to 1.1 contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation [1]. This allows attackers to inject arbitrary HTML and JavaScript.

Exploitation

To exploit, an attacker must trick a privileged user (such as an admin) into clicking a crafted link or visiting a specially prepared page [1]. The malicious payload is reflected back to the user without proper sanitization, executing in the context of the victim's browser.

Impact

Successful exploitation enables the attacker to inject malicious scripts, including redirects, advertisements, and other HTML payloads [1]. This can lead to compromised site integrity, phishing attacks, or unauthorized actions performed on behalf of the victim.

Mitigation

Users should update the plugin to a patched version if available. Until then, applying a Web Application Firewall rule, such as those provided by Patchstack, can block exploit attempts [1]. The vulnerability is predicted to be actively exploited in mass campaigns.