CVE-2025-13364: WP Maps Plugin Stored XSS Vulnerability

CVE-2025-13364 Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin for WordPress. The vulnerability exists in the put_wpgm shortcode functionality due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject arbitrary web scripts into pages, which execute whenever a user accesses the compromised page.

Critical Impact

Authenticated attackers with contributor privileges can inject persistent malicious scripts that execute in the browsers of all users viewing affected pages, potentially leading to session hijacking, credential theft, or further site compromise.

Affected Products

• WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin for WordPress versions up to and including 4.8.7
• WordPress sites using vulnerable versions of the wp-google-map-plugin

Discovery Timeline

• 2026-04-16 - CVE CVE-2025-13364 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2025-13364

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The flaw resides in how the WP Maps plugin processes user-supplied attributes within the put_wpgm shortcode. When contributors or authors create content using this shortcode, the plugin fails to properly sanitize and escape attribute values before rendering them in the page output.

The network-accessible nature of this vulnerability allows remote exploitation without any user interaction once the malicious content is published. Since the attack requires only contributor-level privileges, any WordPress site with multiple content authors faces increased risk. The stored nature of the XSS means the malicious payload persists in the database and executes for every user who views the affected page.

Root Cause

The root cause of this vulnerability stems from insufficient input sanitization and output escaping mechanisms in the shortcode handler function. When processing the put_wpgm shortcode, the plugin directly incorporates user-supplied attribute values into the page HTML without adequate validation or encoding. This allows specially crafted attribute values containing JavaScript code to be stored in the WordPress database and subsequently rendered as executable scripts in users' browsers.

Attack Vector

The attack vector is network-based, requiring an authenticated attacker with at least contributor-level access to the WordPress installation. The attacker can craft a malicious shortcode with JavaScript payloads embedded in the shortcode attributes. When the content containing this shortcode is published and viewed by other users (including administrators), the injected script executes within their browser session.

The vulnerability can be exploited by creating a post or page containing the put_wpgm shortcode with malicious attribute values. The injected script could steal session cookies, redirect users to phishing pages, modify page content, or perform actions on behalf of authenticated users. For technical details on the specific code changes, see the WordPress Plugin Change Log.

Detection Methods for CVE-2025-13364

Indicators of Compromise

• Unexpected JavaScript code within post content containing put_wpgm shortcodes
• Anomalous shortcode attribute values containing event handlers (e.g., onload, onerror, onclick) or script tags
• Browser console errors indicating blocked XSS attempts if Content Security Policy is enabled
• User reports of unexpected redirects or pop-ups when viewing pages with maps

Detection Strategies

• Perform regular security audits of WordPress content for suspicious shortcode patterns and embedded scripts
• Implement Web Application Firewall (WAF) rules to detect XSS payloads in POST requests to the WordPress editor
• Monitor WordPress plugin versions and compare against known vulnerable versions
• Review contributor and author activity logs for unusual content modifications

Monitoring Recommendations

• Enable and monitor Content Security Policy (CSP) violation reports for script injection attempts
• Configure SentinelOne Singularity to monitor WordPress installation directories for unauthorized modifications
• Implement real-time alerting for new posts or pages containing suspicious shortcode patterns
• Regularly scan the WordPress database for stored XSS payloads in post content fields

How to Mitigate CVE-2025-13364

Immediate Actions Required

• Update the WP Maps plugin to version 4.8.8 or later immediately
• Review all existing content containing put_wpgm shortcodes for potential malicious payloads
• Audit user accounts with contributor-level access or higher to identify potentially compromised accounts
• Implement Content Security Policy headers to mitigate the impact of any stored XSS payloads

Patch Information

The vulnerability has been addressed in WP Maps plugin version 4.8.8. The patch implements proper input sanitization and output escaping for shortcode attributes. Administrators should update to the latest version through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository. The specific code changes can be reviewed in the WordPress Plugin Change Log. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the WP Maps plugin until the update can be applied
• Restrict contributor and author roles to trusted users only until patching is complete
• Implement a WAF rule to filter potentially malicious shortcode attributes
• Enable strict Content Security Policy headers to prevent inline script execution

# Add CSP header to Apache .htaccess as a temporary mitigation
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://maps.googleapis.com https://api.mapbox.com; style-src 'self' 'unsafe-inline';"