cleantalk
Vulnerabilities and Security Researches

WordPress Plugin for Google Maps – WP MAPS, CVE-2025-3504

CVE, Research URL

CVE-2025-3504

Home page URL

Security reports for WordPress Plugin for Google Maps – WP MAPS

Application

WordPress Plugin for Google Maps – WP MAPS

Published on
May 01, 2025
Research Description
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected versions
max 4.7.2.
Status
vulnerable
Previous vulnerability researches
Skyword API Plugin (CVE-2024-11907) , Jan 10, 2025
Skyword API Plugin (CVE-2025-58703) , Apr 25, 2026
New vulnerability
Easy Invoice – Invoice for WordPress, PDF Invoice, Quote for WordPress, WordPress Invoice Plugin (CVE-2025-6324) , Apr 25, 2026
WordPress Plugin for Google Maps – WP MAPS (CVE-2025-3504) , Apr 25, 2026
Restrict User Registration (CVE-2025-9892) , Apr 25, 2026
SnapWidget Social Photo Feed Widget (CVE-2025-58241) , Apr 25, 2026
Cozy Blocks – Page Builder Blocks for FSE and Gutenberg Editor, Gutenberg Blocks, WooCommerce Blocks, Post Blocks, Slider (CVE-2025-59573) , Apr 25, 2026