CVE-2025-11307 — WP Google Maps < 9.0.48 - Unauthenticated Stored XSS

CVE-2025-11307

WP Google Maps < 9.0.48 - Unauthenticated Stored XSS PUBLISHED

Description (CNA)

The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Go Maps (formerly WP Google Maps)	affected 0 before 9.0.48

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/f5b21a05-7a51-4530-9e07-4700f00eeca3/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.