CVE-2025-9123: CBX Map WordPress Plugin XSS Vulnerability

CVE-2025-9123 Overview

CVE-2025-9123 is a Stored Cross-Site Scripting (XSS) vulnerability in the CBX Map for Google Map & OpenStreetMap plugin for WordPress. The flaw affects all plugin versions up to and including 2.0.1. It stems from insufficient input sanitization and output escaping of the popup heading and location address parameters. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browsers of any users who view the affected pages. The weakness is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can store malicious JavaScript that executes against site visitors and administrators, enabling session theft, forced actions, and content manipulation.

Affected Products

CBX Map for Google Map & OpenStreetMap WordPress plugin, versions up through 2.0.1
WordPress sites with Contributor-level accounts or higher permitted to add map blocks
Any site rendering unescaped popup heading or location address output from the plugin

Discovery Timeline

2025-09-11 - CVE-2025-9123 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9123

Vulnerability Analysis

The plugin accepts user-supplied values for the popup heading and location address fields when configuring map entries. These values are stored in the WordPress database and later rendered inside map popups without proper sanitization or output escaping. An authenticated attacker with Contributor privileges can submit payloads containing HTML and JavaScript. When administrators or visitors view a page containing the injected map, the browser executes the attacker-controlled script in the site's origin.

Because the scope is marked as changed, the impact crosses a security boundary: a low-privileged contributor can affect higher-privileged administrators and anonymous visitors. Successful exploitation can lead to administrator session hijacking, forced privileged actions through CSRF-style requests, redirection to attacker-controlled infrastructure, or injection of SEO spam and cryptominers.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on render for the popup heading and location address parameters. WordPress provides helpers such as sanitize_text_field(), wp_kses(), and esc_html() or esc_attr(), but the vulnerable code paths do not apply them consistently to these specific fields.

Attack Vector

The attack vector is network-based and requires authentication at the Contributor level. An attacker logs into WordPress, creates or edits content containing a CBX Map, and supplies a crafted payload in the popup heading or location address field. The payload is persisted in post or option storage. When another authenticated user or visitor loads a page that renders the map, the stored script executes. See the Wordfence Vulnerability Analysis for additional technical context.

No verified public exploit code is available for CVE-2025-9123.
The vulnerability is described in prose based on the vendor advisory.

Detection Methods for CVE-2025-9123

Indicators of Compromise

Stored map entries containing <script>, onerror=, onload=, or javascript: substrings in popup heading or address fields
Unexpected outbound HTTP requests from administrator browsers to unfamiliar domains after viewing pages with CBX Map blocks
New administrator accounts, modified user roles, or altered siteurl and home options following Contributor account activity
Browser console errors or Content Security Policy violations tied to map rendering endpoints

Detection Strategies

Query the WordPress database for CBX Map post meta and options containing HTML event handlers or script tags.
Monitor wp-admin sessions for unexpected XHR or fetch requests originating from pages that embed CBX Maps.
Review audit logs for Contributor-level accounts that create or edit map content shortly before administrator anomalies.
Scan rendered page HTML with automated DOM analysis tools to find reflected or persisted script content inside map popups.

Monitoring Recommendations

Enable a WordPress activity logging plugin to track post edits and option changes made by Contributor accounts.
Deploy a Content Security Policy that restricts inline scripts and reports violations to a collection endpoint.
Alert on creation of new WordPress administrator users and on changes to privileged user roles.
Monitor web server logs for POST requests to the plugin's save endpoints followed by GET traffic from authenticated administrators.

How to Mitigate CVE-2025-9123

Immediate Actions Required

Update the CBX Map for Google Map & OpenStreetMap plugin to a version later than 2.0.1 as soon as a patched release is published.
Audit all existing map entries for stored script payloads and remove or sanitize any suspicious content.
Review Contributor and higher-level accounts and remove any that are unused, inactive, or unexpected.
Rotate administrator passwords and invalidate active sessions if evidence of exploitation is found.

Patch Information

Refer to the WordPress Plugin Changeset and the WordPress Plugin Overview for the latest release details. Site administrators should apply the fixed version through the WordPress plugin updater once available.

Workarounds

Temporarily deactivate the CBX Map plugin until a patched version can be installed.
Restrict Contributor-level content creation to trusted users and require editorial review before publication.
Deploy a web application firewall rule that blocks requests containing script tags or JavaScript event handlers targeted at plugin endpoints.
Apply a strict Content Security Policy that disallows inline script execution on pages rendering CBX Maps.

bash

# Example: locate stored XSS payloads in WordPress post meta via WP-CLI
wp db query "SELECT post_id, meta_key, meta_value FROM wp_postmeta \
  WHERE meta_key LIKE '%cbxmap%' \
  AND (meta_value LIKE '%<script%' OR meta_value LIKE '%onerror=%' OR meta_value LIKE '%javascript:%');"

# Deactivate the vulnerable plugin until patched
wp plugin deactivate cbxgooglemap