The Flexible Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s Flexible Maps shortcode in all versions up to, and including, 1.18.0 due to insufficient input sanitization and output escaping on user supplied attributes. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages, which will execute whenever a user accesses the affected page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2025-8622 |
Exploitation
To exploit this vulnerability, an authenticated attacker with contributor-level access can craft a malicious shortcode that includes arbitrary JavaScript. When a user accesses a page containing this shortcode, the injected script will execute in the context of the user’s browser, potentially leading to session hijacking or other malicious actions.
Affected Products
- Flexible Map plugin for WordPress (versions up to and including 1.18.0): This plugin allows users to create and manage maps on their WordPress sites, but the vulnerability exposes it to XSS attacks.
Mitigation
To mitigate this vulnerability, users should update the Flexible Map plugin to the latest version where the issue has been resolved. Additionally, implementing proper input sanitization and output escaping practices can help prevent similar vulnerabilities in the future.