CVE-2025-57953: Open User Map DOM-Based XSS Vulnerability

CVE-2025-57953 Overview

CVE-2025-57953 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the 100plugins Open User Map plugin for WordPress [CWE-79]. The flaw affects all versions of open-user-map up to and including 1.4.14. Attackers with low privileges can inject malicious scripts that execute in the browsers of users interacting with the affected page. The vulnerability requires user interaction and results in a scope change, enabling script execution outside the vulnerable component's security context. Impact spans confidentiality, integrity, and availability at a low level across the changed scope.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victims' browsers through the Open User Map plugin, enabling session theft, defacement, and unauthorized actions against WordPress users.

Affected Products

100plugins Open User Map plugin for WordPress
Versions from n/a through 1.4.14
WordPress sites with the open-user-map plugin installed and active

Discovery Timeline

2025-09-22 - CVE CVE-2025-57953 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57953

Vulnerability Analysis

The vulnerability is a DOM-based Cross-Site Scripting (XSS) flaw classified under CWE-79. DOM-based XSS occurs when client-side JavaScript writes attacker-controlled data into the Document Object Model without proper sanitization or encoding. In the Open User Map plugin, user-supplied input is processed by client-side scripts and rendered into the page without adequate neutralization. The exploitation requires an authenticated user with low privileges to submit crafted input, and a victim must interact with the resulting page. The scope change indicates that successful exploitation can affect resources beyond the vulnerable plugin itself, such as other WordPress components or session data.

Root Cause

The root cause is improper neutralization of input during web page generation within the plugin's client-side rendering logic. User-controlled data is inserted into the DOM through unsafe sinks such as innerHTML, document.write, or similar APIs without encoding or sanitization. Refer to the Patchstack XSS Vulnerability Analysis for technical specifics.

Attack Vector

The attack is network-based and requires low privileges plus user interaction. An authenticated attacker submits malicious payloads containing JavaScript through plugin input fields. When another user visits a page that renders this input client-side, the browser executes the injected script in the context of the victim's session. The EPSS score is 0.313%, indicating current exploitation likelihood is low.

// No verified exploitation code is publicly available.
// Refer to the Patchstack advisory for technical details.

Detection Methods for CVE-2025-57953

Indicators of Compromise

Unexpected <script> tags, event handlers, or javascript: URIs stored in Open User Map data fields such as map markers, user profiles, or location descriptions.
WordPress audit log entries showing low-privileged accounts submitting unusually long or encoded strings to plugin endpoints.
Browser console errors or Content Security Policy (CSP) violation reports originating from pages rendering Open User Map content.

Detection Strategies

Inspect database tables used by open-user-map for payloads containing HTML tags, encoded characters, or JavaScript keywords such as onerror, onload, or eval.
Deploy a Web Application Firewall (WAF) rule to flag requests to Open User Map AJAX endpoints that contain script-like payloads.
Review browser telemetry for anomalous script execution on pages hosting the plugin.

Monitoring Recommendations

Enable WordPress activity logging and alert on new or modified Open User Map entries submitted by low-privilege accounts.
Monitor outbound requests from browsers rendering plugin content to detect data exfiltration triggered by injected scripts.
Track plugin version inventory across all WordPress sites to identify instances still running 1.4.14 or earlier.

How to Mitigate CVE-2025-57953

Immediate Actions Required

Update the Open User Map plugin to a version later than 1.4.14 as soon as a patched release is available from 100plugins.
Restrict user registration and the roles permitted to submit map entries until the plugin is updated.
Audit existing plugin data for stored payloads and remove any entries containing HTML or script content.

Patch Information

At the time of publication, the vulnerability affects Open User Map versions up to and including 1.4.14. Monitor the Patchstack advisory and the WordPress plugin repository for the fixed release.

Workarounds

Deactivate the Open User Map plugin until a patched version is installed.
Deploy a WAF rule to block requests containing <script>, javascript:, or common XSS payload patterns targeting plugin endpoints.
Implement a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.

bash

# Example CSP header to mitigate DOM-based XSS execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'