CVE-2025-11307: WP Go Maps XSS Vulnerability

CVE-2025-11307 Overview

CVE-2025-11307 affects the WP Go Maps (formerly WP Google Maps) WordPress plugin in versions prior to 9.0.48. The plugin fails to sanitize user input submitted through an AJAX action. Unauthenticated attackers can store cross-site scripting (XSS) payloads that the plugin later retrieves through a separate AJAX call and outputs without escaping. When an administrator or other authenticated user triggers the vulnerable retrieval path, the stored payload executes in their browser context.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into vulnerable WordPress sites, leading to session hijacking, administrative account takeover, and full site compromise.

Affected Products

WP Go Maps (formerly WP Google Maps) WordPress plugin versions before 9.0.48
WordPress sites with the vulnerable plugin installed and active
Any administrator session interacting with the plugin's affected AJAX endpoints

Discovery Timeline

2025-11-11 - CVE-2025-11307 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11307

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) flaw exposed through an AJAX endpoint that accepts unauthenticated input. The plugin writes attacker-supplied data into persistent storage without sanitization. A subsequent AJAX action reads that data and emits it into the response without HTML escaping. When an administrator or editor loads a page that triggers the retrieval AJAX call, the browser parses and executes the injected script.

Exploitation requires user interaction from a privileged user to load the affected interface. Successful execution gives the attacker code execution in the privileged user's browser session, enabling theft of authentication cookies, creation of rogue administrator accounts, and arbitrary modifications to plugin and site settings. The EPSS score of 2.635% places this issue in the 85th percentile for likelihood of exploitation activity.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on read across two AJAX handlers. The vulnerable plugin code does not call WordPress sanitization helpers such as sanitize_text_field() or wp_kses() on incoming parameters. The retrieval path does not apply esc_html() or esc_attr() before emitting stored values, allowing raw <script> tags and event handler attributes to render in the DOM.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker sends a crafted POST request to the vulnerable AJAX action (typically admin-ajax.php with the plugin's action name) containing a JavaScript payload in a controlled parameter. The payload is stored in the database. When a legitimate administrator visits a page that invokes the retrieval AJAX call, the payload returns in the response and executes. The vulnerability does not require an account on the target WordPress installation.

No verified public proof-of-concept code is currently available. Refer to the WPScan Vulnerability Report for further technical context.

Detection Methods for CVE-2025-11307

Indicators of Compromise

Unauthenticated POST requests to admin-ajax.php referencing WP Go Maps action names with payloads containing <script>, onerror=, onload=, or javascript: strings
Unexpected creation of WordPress administrator accounts shortly after anomalous AJAX traffic to the plugin
Modifications to plugin configuration tables containing HTML or JavaScript content in fields that should hold plain text
Outbound requests from administrator browsers to attacker-controlled domains following access to map management pages

Detection Strategies

Inspect web server access logs for POST requests to wp-admin/admin-ajax.php with WP Go Maps action parameters and script-like content in the body
Query the WordPress database for plugin tables and options containing <script, onerror=, or encoded equivalents such as %3Cscript
Monitor for newly created wp_users rows with administrator role correlated with prior plugin AJAX activity

Monitoring Recommendations

Enable WordPress audit logging to capture all administrative actions, user creation events, and plugin configuration changes
Forward web server and WordPress logs to a centralized SIEM for correlation against unauthenticated AJAX traffic patterns
Deploy a Web Application Firewall (WAF) ruleset that inspects admin-ajax.php parameters for XSS signatures

How to Mitigate CVE-2025-11307

Immediate Actions Required

Update the WP Go Maps plugin to version 9.0.48 or later on every affected WordPress installation
Audit the WordPress database for stored payloads containing HTML or JavaScript in WP Go Maps tables and remove malicious entries
Force password resets for all administrator and editor accounts that accessed the plugin interface while the vulnerable version was active
Review installed users and remove any unrecognized administrator accounts

Patch Information

The vendor addressed the vulnerability in WP Go Maps version 9.0.48. Update through the WordPress plugin dashboard or by replacing the plugin files with the patched release. Verify the installed version under Plugins after upgrade. See the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate the WP Go Maps plugin until the patched version can be installed
Restrict access to wp-admin/admin-ajax.php from untrusted networks using WAF rules or server-level access controls
Apply a WAF signature blocking requests to the plugin's AJAX actions that contain script tags or JavaScript event handlers

bash

# Configuration example - update WP Go Maps via WP-CLI
wp plugin update wp-google-maps --version=9.0.48
wp plugin list --name=wp-google-maps --fields=name,status,version