CVE-2025-15345: MapGeo WordPress Plugin XSS Vulnerability

CVE-2025-15345 Overview

CVE-2025-15345 is a Reflected Cross-Site Scripting (XSS) vulnerability in the MapGeo – Interactive Geo Maps plugin for WordPress. The flaw exists in all plugin versions up to and including 1.6.27. It stems from insufficient input sanitization and output escaping on the map parameter within the display-map shortcode. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link. The vulnerability is tracked under CWE-80: Improper Neutralization of Script-Related HTML Tags. Version 1.6.28 of the plugin remediates the issue.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions against WordPress sites running vulnerable installations of the MapGeo plugin.

Affected Products

MapGeo – Interactive Geo Maps plugin for WordPress, all versions up to and including 1.6.27
WordPress sites embedding the display-map shortcode
Fixed in MapGeo – Interactive Geo Maps version 1.6.28

Discovery Timeline

2026-05-14 - CVE-2025-15345 published to the National Vulnerability Database (NVD)
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2025-15345

Vulnerability Analysis

The vulnerability resides in the display-map shortcode handler implemented in src/Plugin/Map.php. The shortcode accepts a map parameter supplied through user-controlled input. The plugin renders this parameter into the HTML response without applying adequate sanitization or output escaping. As a result, an attacker can craft a URL containing JavaScript payloads in the map parameter. When a victim visits the malicious link, the payload reflects back into the rendered page and executes in the browser context of the WordPress site. Successful exploitation can lead to session token theft, forced administrative actions, redirection to attacker-controlled domains, or the delivery of follow-on malware.

Root Cause

The root cause is missing input sanitization and missing output escaping in the shortcode rendering logic. The plugin treats the map parameter as trusted content and injects it directly into the DOM. WordPress provides escaping primitives such as esc_attr(), esc_html(), and wp_kses() that should be applied to any untrusted attribute or text rendered into a page. The vulnerable code path bypasses these protections, falling under CWE-80.

Attack Vector

The attack is network-based and requires user interaction. An attacker constructs a URL pointing to a vulnerable WordPress page that renders the display-map shortcode, appending a malicious payload via the map parameter. The attacker delivers the link through phishing emails, social media, forum posts, or malvertising. When a logged-in WordPress user follows the link, the injected script executes with the privileges of that user's session. Because the scope is changed (CVSS S:C), the injected script can affect resources beyond the vulnerable component, including authenticated administrative interfaces.

No verified proof-of-concept code is published. Technical details are available in the WordPress Plugin Changeset and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-15345

Indicators of Compromise

HTTP request logs containing map= parameter values with encoded <script>, onerror=, onload=, or javascript: tokens
Referer headers pointing to external attacker-controlled domains followed by requests to pages embedding the display-map shortcode
Unexpected outbound browser requests from authenticated WordPress administrators to unknown hosts
Newly created WordPress administrative users or modified plugin/theme files following user interaction with suspicious links

Detection Strategies

Inspect WordPress access logs for query strings on shortcode-enabled URLs that contain HTML or JavaScript metacharacters such as <, >, ", or URL-encoded equivalents
Deploy a web application firewall (WAF) ruleset that flags reflected XSS payloads targeting the map parameter
Use browser-side Content Security Policy (CSP) violation reporting to surface unexpected inline script execution
Audit installed plugin versions against the vulnerable range, flagging any MapGeo – Interactive Geo Maps instance at or below 1.6.27

Monitoring Recommendations

Continuously monitor WordPress plugin inventories for outdated versions of MapGeo – Interactive Geo Maps
Alert on administrative session activity originating from unusual IP addresses or geographies shortly after click-through events
Forward web server and WAF logs to a centralized analytics platform for pattern analysis of reflected payloads

How to Mitigate CVE-2025-15345

Immediate Actions Required

Update the MapGeo – Interactive Geo Maps plugin to version 1.6.28 or later on all affected WordPress sites
Inventory all WordPress sites for the plugin and prioritize upgrades on internet-facing administrative instances
Rotate session cookies and credentials for administrative users who may have followed untrusted links
Enforce a strict Content Security Policy that disallows inline script execution and unapproved script sources

Patch Information

The vendor addressed the vulnerability in MapGeo – Interactive Geo Maps version 1.6.28. The fix updates src/Plugin/Map.php to properly sanitize and escape the map shortcode parameter. Review the WordPress Plugin Changeset for the exact code changes. Additional vendor-neutral analysis is available from CleanTalk and Wordfence.

Workarounds

Temporarily remove or disable the display-map shortcode usage on public pages until the plugin is upgraded
Deploy WAF rules that block requests containing script-injection patterns in the map query parameter
Restrict the WordPress administrator interface to known IP ranges via network access controls
Educate administrative users to avoid clicking unsolicited links that reference plugin shortcode pages

bash

# Configuration example: WordPress CLI plugin upgrade
wp plugin update interactive-geo-maps --version=1.6.28
wp plugin list --name=interactive-geo-maps --fields=name,version,status