CVE-2025-2055

Description

The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.

Reserved 2025-03-06 | Published 2025-04-03 | Updated 2025-04-03 | Assigner WPScan

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Default status
unaffected

Any version before 2.94.9
affected

Credits

Dmitrii Ignatyev finder

WPScan coordinator

References

wpscan.com/...rability/a8bfdbbf-6963-4fab-826a-6be770ac72c3/ exploit vdb-entry technical-description

cve.org (CVE-2025-2055)

nvd.nist.gov (CVE-2025-2055)

Download JSON