CVE-2025-12662: Coon Google Maps WordPress XSS Vulnerability

CVE-2025-12662 Overview

CVE-2025-12662 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Coon Google Maps plugin for WordPress. The flaw affects all plugin versions up to and including 1.0. The plugin fails to sanitize the height parameter within the map shortcode, allowing authenticated users with contributor-level access or higher to inject arbitrary JavaScript into pages. Injected scripts execute in the browser of any visitor who loads the affected page, enabling session theft, redirection, or actions performed on behalf of higher-privileged users.

Critical Impact
Authenticated contributors can persist JavaScript payloads in WordPress content that execute against site visitors, including administrators, enabling account takeover and site compromise.

Affected Products

Coon Google Maps plugin for WordPress — all versions through 1.0
WordPress sites accepting contributor-or-higher registrations
Any WordPress instance using the map shortcode from this plugin

Discovery Timeline

2025-11-11 - CVE-2025-12662 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12662

Vulnerability Analysis

The vulnerability resides in the plugin's map shortcode handler, referenced in the plugin source at coon-google-maps.php line 71. The shortcode accepts a height attribute that is echoed directly into the rendered HTML without proper sanitization or escaping. An authenticated attacker with contributor privileges can insert the shortcode into a post or page and supply a crafted height value that breaks out of the intended HTML attribute context. The injected payload becomes stored content, executing each time a user requests the affected page.

Because WordPress contributor accounts can create draft posts requiring editor or administrator review, the payload commonly executes in the browser of a privileged reviewer. This can lead to authentication cookie theft, forced administrative actions via CSRF, or persistent backdoor installation through plugin or theme modification.

Root Cause

The root cause is insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. The plugin trusts the height attribute value and inserts it into HTML output without applying WordPress escaping functions such as esc_attr() or absint() for numeric dimensions.

Attack Vector

Exploitation requires network access to the WordPress site and authentication as a contributor or higher. The attacker creates or edits a post containing the vulnerable shortcode with a malicious height value. When a visitor or reviewer loads the page, the browser parses and executes the injected script under the site's origin. See the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for source-level details.

No public proof-of-concept exploit code is available. The vulnerability mechanism follows the standard pattern of unsanitized shortcode attribute output described in the referenced advisory.

Detection Methods for CVE-2025-12662

Indicators of Compromise

Post or page content containing [map] shortcodes with height attribute values that include HTML characters such as ", <, >, or on*= event handlers
Unexpected <script> tags or inline JavaScript rendered within map container elements on published pages
Contributor or author accounts creating posts that embed the Coon Google Maps shortcode with abnormally long or encoded attribute values
Outbound requests from visitor browsers to attacker-controlled domains originating from pages using the plugin

Detection Strategies

Query the wp_posts table for post_content matching the pattern [map combined with suspicious characters in the height attribute
Enable Content Security Policy (CSP) reporting to capture inline script violations on pages rendering the plugin shortcode
Review WordPress audit logs for contributor-level accounts publishing or updating posts containing the shortcode

Monitoring Recommendations

Monitor administrator session activity for anomalous actions immediately following review of contributor-submitted posts
Alert on creation of new administrator accounts, plugin installations, or theme file modifications performed from unusual sessions
Track outbound HTTP requests from the WordPress origin to newly observed external domains referenced in page content

How to Mitigate CVE-2025-12662

Immediate Actions Required

Deactivate and remove the Coon Google Maps plugin until a patched version becomes available
Audit all posts and pages for use of the [map] shortcode and inspect attribute values for injected payloads
Restrict contributor and author role assignments to trusted users only and review recent role changes
Rotate administrator credentials and invalidate active sessions if evidence of exploitation exists

Patch Information

As of the latest NVD update, no fixed version beyond 1.0 has been published. Monitor the WordPress Coon Google Maps Plugin page for a patched release. Until a fix is available, removal is the recommended path.

Workarounds

Remove or disable the plugin on production sites
Deploy a Web Application Firewall (WAF) rule blocking POST requests to wp-admin/post.php where the payload contains [map combined with HTML metacharacters in the height parameter
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Downgrade contributor accounts or require editorial approval workflows that render post previews in an isolated sandbox

bash

# Example: locate posts containing the vulnerable shortcode via WP-CLI
wp db query "SELECT ID, post_title, post_author, post_status \
  FROM wp_posts \
  WHERE post_content LIKE '%[map %height=%' \
  AND post_status IN ('publish','draft','pending');"

# Deactivate the plugin site-wide
wp plugin deactivate coon-google-maps
wp plugin delete coon-google-maps