CVE-2025-31557

Vulnerability

Overview CVE-2025-31557 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the OSM (OpenStreetMap) plugin for WordPress, affecting versions up to and including 6.1.13 [1]. The issue arises from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into the DOM of a victim's browser.

Exploitation

Details Exploitation requires a privileged user (e.g., an administrator) to perform an action such as clicking a malicious link or visiting a crafted page [1]. This user interaction is necessary for the attack to succeed. The vulnerability is known to be used in mass-exploit campaigns targeting thousands of websites, regardless of their size or popularity [1].

Impact

Successful exploitation enables an attacker to inject malicious scripts, including redirects, advertisements, and other HTML payloads, which execute when visitors access the affected site [1]. This can lead to defacement, data theft, or further compromise.

Mitigation

The vulnerability has been patched in version 6.1.14 of the OSM plugin. Users are strongly advised to update immediately. If updating is not possible, consulting a hosting provider or web developer is recommended [1].