CVE-2025-9352: Pronamic Google Maps WordPress XSS Flaw

CVE-2025-9352 Overview

The Pronamic Google Maps plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the description field. The flaw affects all versions up to and including 2.4.1 and stems from insufficient input sanitization and output escaping. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page. The vulnerability is tracked under CWE-79 and was publicly disclosed through the Wordfence Vulnerability Report.

Critical Impact
Authenticated contributors can store malicious JavaScript in map descriptions, enabling session hijacking, credential theft, or administrative account takeover when triggered by higher-privileged users.

Affected Products

Pronamic Google Maps plugin for WordPress, versions ≤ 2.4.1
WordPress sites allowing Contributor-level user registration
Any site embedding Pronamic Google Maps content without additional output filtering

Discovery Timeline

2025-08-28 - CVE-2025-9352 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9352

Vulnerability Analysis

The vulnerability resides in how the plugin renders map metadata back into the page. The plugin stores the map description provided by authors and injects it into HTML output without adequate sanitization or escaping. An attacker with Contributor privileges supplies a description containing JavaScript. When another user loads a page embedding the map, the browser parses and executes the attacker-controlled script in the context of the WordPress site. Because the script executes under the viewer's session, attackers can perform actions on behalf of administrators, exfiltrate cookies, or pivot into further compromise of the WordPress installation.

Root Cause

The original implementation serialized map information as JSON into a hidden HTML <input name="pgm-info"> element that was later parsed by client-side JavaScript. User-controlled fields such as the description were not consistently escaped for an HTML attribute context, allowing attribute-breaking payloads to inject arbitrary markup and script tags.

Attack Vector

Exploitation requires an authenticated session with Contributor-level permissions or higher. The attacker creates or edits a post using the plugin's map shortcode or block and supplies a payload inside the description field. Once the post is viewed, the stored payload executes in the victim's browser. No user interaction beyond navigating to the affected page is required.

php

// Security patch in classes/Pronamic/Google/Maps/Maps.php
// Replaces hidden HTML input with escaped data attribute and JSON via wp_json_encode

 * @param Pronamic_Google_Maps_Info $info
 */
public static function get_map_html( Pronamic_Google_Maps_Info $info ) {
-    $content = '<div class="pgm">';
+    static $id = 0;
+
+    $id++;
+
+    $jsVar = 'pgmInfo' . $id;
+
+    $content = sprintf( '<div class="pgm" data-pronamic-google-maps-info-var="%s">', esc_attr( $jsVar ) );
+
+    $content .= \sprintf( '<script>window.%s = %s;</script>', $jsVar, \wp_json_encode( $info ) );

    $width  = Pronamic_Google_Maps_Size::parse( $info->width );
    $height = Pronamic_Google_Maps_Size::parse( $info->height );

Source: Pronamic Google Maps commit b71e6f6

The companion change in js/site.js reads the map data from a window variable referenced by a data- attribute instead of parsing untrusted HTML input values, removing the attribute-injection surface entirely.

Detection Methods for CVE-2025-9352

Indicators of Compromise

Posts or pages containing Pronamic Google Maps shortcodes or blocks with <script>, onerror, onload, or javascript: payloads inside the description field.
Database rows in wp_posts or related meta tables where map description content includes HTML event handlers or encoded script fragments.
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains after viewing a map-enabled page.

Detection Strategies

Audit all content authored by Contributor-level accounts for Pronamic Google Maps blocks and inspect description fields for HTML tags or event handlers.
Deploy a web application firewall rule to flag POST requests to WordPress endpoints containing map description payloads with script-related tokens.
Review browser Content Security Policy (CSP) violation reports for inline script executions originating from pages that embed the plugin.

Monitoring Recommendations

Monitor the /wp-admin/post.php and REST API /wp/v2/posts endpoints for Contributor submissions containing suspicious HTML.
Alert on anomalous administrator session activity, including unexpected privilege changes, new user creation, or plugin installations following page views.
Track plugin version inventory across all WordPress hosts and flag installations running ≤ 2.4.1.

How to Mitigate CVE-2025-9352

Immediate Actions Required

Update the Pronamic Google Maps plugin to the patched release that includes commit b71e6f6a8fc61ac1065a0a2789490cb058b1bffe.
Review and sanitize existing map descriptions authored by non-administrator users before re-enabling the plugin.
Rotate credentials for any administrator who viewed suspicious map-enabled pages while an exploit may have been active.

Patch Information

The fix is published in the Pronamic Google Maps GitHub commit and reflected in the WordPress plugin changeset 3349668. The patch removes the hidden HTML input used to pass JSON into the client and instead encodes map data via wp_json_encode into a dedicated window variable referenced by an escaped data- attribute.

Workarounds

Restrict Contributor and Author roles from using the plugin's shortcodes or blocks until patching is complete.
Enforce a strict Content Security Policy that disallows inline scripts, limiting the impact of stored XSS payloads.
Temporarily disable the plugin on production sites that permit untrusted content authors.

bash

# Update the plugin via WP-CLI to the patched version
wp plugin update pronamic-google-maps

# Verify the installed version is no longer vulnerable
wp plugin get pronamic-google-maps --field=version

# Audit posts for suspicious map description content
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%pronamic_google_maps%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%');"