CVE-2025-9205: MapSVG WordPress Plugin XSS Vulnerability

CVE-2025-9205 Overview

CVE-2025-9205 is a stored Cross-Site Scripting (XSS) vulnerability in the MapSVG plugin for WordPress. The flaw affects all plugin versions up to and including 8.14.0. It stems from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's map options.

Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into map configurations. Injected scripts execute in the browser of any visitor who accesses the affected page. This vulnerability is tracked under [CWE-79] and carries a CVSS score of 6.4.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, forced administrative actions, or drive-by redirection.

Affected Products

MapSVG plugin for WordPress — all versions up to and including 8.14.0
MapSVG Lite Interactive Vector Maps (WordPress.org distribution)
WordPress sites permitting contributor-level or higher user registration

Discovery Timeline

2026-07-24 - CVE-2025-9205 published to the National Vulnerability Database
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2025-9205

Vulnerability Analysis

The MapSVG plugin renders interactive vector maps configured through map option attributes stored in the WordPress database. The plugin fails to sanitize input on write and does not escape output on render for these attributes. As a result, malicious payloads stored in map options are emitted directly into page HTML.

Because the payload persists in the database, the XSS is stored rather than reflected. Every visitor loading a page that renders the tainted map triggers execution. Attackers can hijack authenticated sessions, perform actions as higher-privileged users, or pivot to full site takeover if an administrator views the page.

Exploitation requires a valid account at contributor level or above, which lowers the barrier on sites that permit open registration or delegate content creation to untrusted parties. The Admin.php handler at line 233 in the MapSVG source tree illustrates where option handling occurs.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on render. Map option attributes accept arbitrary strings and are echoed into HTML context without passing through WordPress escaping functions such as esc_attr() or wp_kses().

Attack Vector

An authenticated attacker with contributor privileges edits a MapSVG map and injects a JavaScript payload into a vulnerable option attribute. The payload persists in the site database. When any user, including administrators, visits a page embedding the map, the injected script executes in their browser session under the site's origin. Review the Wordfence advisory for further exploitation context.

Detection Methods for CVE-2025-9205

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored within MapSVG option records in the wp_options or plugin-specific tables
Outbound browser requests from administrator sessions to unfamiliar domains after loading pages containing MapSVG maps
New administrator accounts or modified user roles created shortly after a contributor edits a MapSVG map
Content Security Policy violation reports referencing MapSVG-rendered pages

Detection Strategies

Audit MapSVG map configurations for HTML or JavaScript syntax inside option attributes that should hold plain text
Review WordPress audit logs for contributor accounts editing or creating MapSVG maps, correlating with visitor traffic to those pages
Deploy web application firewall rules that inspect POST requests to MapSVG admin endpoints for script payloads

Monitoring Recommendations

Enable verbose logging on wp-admin/admin-ajax.php and MapSVG REST endpoints to capture map-save operations
Alert on administrator sessions that trigger unusual DOM activity or cross-origin requests on public map pages
Track new or recently promoted contributor accounts and monitor their content changes

How to Mitigate CVE-2025-9205

Immediate Actions Required

Update the MapSVG plugin to a version later than 8.14.0 as soon as a patched release is available from the vendor
Audit all existing MapSVG map options for injected scripts and remove tainted content
Restrict contributor-level and above accounts to trusted users and disable open registration where feasible
Force password resets and invalidate active sessions if injection is confirmed

Patch Information

Refer to the MapSVG changeset on WordPress.org for the fix commit and confirm the installed plugin version is later than 8.14.0. Verify the update through the WordPress admin plugins screen.

Workarounds

Deactivate the MapSVG plugin until a fixed version is deployed on production sites
Remove contributor and author role capabilities to create or edit MapSVG maps via a role management plugin
Deploy a Content Security Policy that disallows inline scripts on pages rendering MapSVG output
Add web application firewall rules to block script tags and JavaScript event handlers in MapSVG POST parameters

bash

# Configuration example: force plugin deactivation via WP-CLI until patched
wp plugin deactivate mapsvg-lite-interactive-vector-maps
wp plugin deactivate mapsvg