CVE-2025-23775 Overview
CVE-2025-23775 is a stored cross-site scripting (XSS) vulnerability in the WWP GMAPS for WPBakery Page Builder Free WordPress plugin. The flaw affects the gmaps-for-visual-composer-free plugin from unspecified versions through version 1.2. Attackers with contributor-level access or higher can inject malicious JavaScript that persists in the database and executes in the browsers of site visitors and administrators. The vulnerability maps to [CWE-79] and stems from improper neutralization of user-supplied input during web page generation.
Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in victims' browsers, enabling session theft, administrative account takeover, and defacement of WordPress sites using the affected plugin.
Affected Products
- WWP GMAPS for WPBakery Page Builder Free (gmaps-for-visual-composer-free)
- All versions up to and including 1.2
- WordPress installations using WPBakery Page Builder with the GMAPS extension
Discovery Timeline
- 2025-01-16 - CVE-2025-23775 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-23775
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw in the GMAPS for WPBakery Page Builder Free plugin. The plugin fails to properly sanitize and escape user-supplied input before storing it in the WordPress database and rendering it on generated pages. When an attacker submits crafted input containing HTML or JavaScript, the payload is written to persistent storage and later reflected without adequate encoding.
Exploitation requires an authenticated user with the ability to edit content that uses the plugin's shortcodes or map configuration fields. User interaction is required, meaning a victim must visit a page containing the injected payload. The scope changes from the vulnerable component to the browser security context, allowing the attacker to affect resources beyond the plugin itself.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin does not apply WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses() to attribute values or content passed into map shortcodes. Input persists in wp_postmeta or wp_options and is echoed into the DOM verbatim.
Attack Vector
An authenticated attacker with contributor or higher privileges submits a page or post containing a GMAPS shortcode with a malicious attribute value. The payload embeds JavaScript within an event handler or <script> context. When a site visitor or administrator loads the page, the browser executes the injected script under the site's origin. Consult the Patchstack XSS Vulnerability Advisory for the technical writeup.
No public proof-of-concept exploit code is available for this vulnerability.
Detection Methods for CVE-2025-23775
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or on* event handlers stored in wp_postmeta rows associated with GMAPS shortcodes.
- Outbound HTTP requests from visitor browsers to attacker-controlled domains referrer-chained from posts containing GMAPS content.
- New or modified administrator accounts created shortly after content edits by contributor-level users.
- Anomalous session cookie exfiltration patterns in web server access logs.
Detection Strategies
- Audit all post content and post meta values for GMAPS shortcode attributes containing HTML entities, script tags, or event handlers.
- Deploy a web application firewall rule set that inspects POST bodies to wp-admin/post.php for XSS signatures targeting shortcode parameters.
- Review WordPress user activity logs for contributor accounts publishing content containing map shortcodes with suspicious attribute values.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture inline script violations originating from plugin-generated markup.
- Monitor for unauthorized privilege changes and unexpected creation of administrator accounts.
- Alert on WordPress core and plugin file integrity changes across the wp-content/plugins/gmaps-for-visual-composer-free/ directory.
How to Mitigate CVE-2025-23775
Immediate Actions Required
- Deactivate and remove the GMAPS for WPBakery Page Builder Free plugin until a patched release is confirmed available.
- Restrict contributor and author role assignments to trusted users only, since exploitation requires authenticated access.
- Rotate WordPress administrator credentials and invalidate active sessions if the plugin has been in use on multi-author sites.
- Scan the database for stored payloads and purge any injected shortcodes from wp_posts and wp_postmeta.
Patch Information
At the time of publication, no fixed version is listed in the advisory. Versions up to and including 1.2 are affected. Monitor the Patchstack XSS Vulnerability Advisory and the plugin's WordPress.org page for a security release.
Workarounds
- Uninstall the plugin and replace map functionality with a maintained alternative that properly escapes shortcode attributes.
- Deploy a virtual patch through a web application firewall to block requests containing script tags or event handlers in GMAPS shortcode parameters.
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Limit editorial workflow so that only editor-level and above users can publish content, requiring review of contributor submissions before they are rendered on public pages.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
