CVE-2025-9044
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Mapster WP Maps plugin for WordPress (versions up to and including 1.20.0) is vulnerable to Stored Cross-Site Scripting via multiple fields due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level permissions and above can inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.
Risk Assessment
An attacker could inject malicious scripts that execute in the user's browser, potentially leading to session theft, content modification, or other actions in the victim's context.
Recommendation
Update the Mapster WP Maps plugin to a version newer than 1.20.0 as soon as a fix is available. Until then, consider restricting contributor permissions or disabling the plugin.
Other vulnerabilities in Mapster WP Maps
See all- CVE-2026-39720High
Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps versions up to 2.0.4.
- CVE-2026-12954High
The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to and including 1.23.0 via the my_profile_update() function. The lack of nonce verification, capability checks, and meta key validation allows an authenticated attacker with Subscriber-level access to modify arbitrary user metadata.
Original NVD description (English source)
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS