CVE-2025-24758

WordPress CM Map Locations plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

Published Mar 3, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through <= 2.0.8.

Analysis

Technical impact

The vulnerability is an improper neutralization of input that results in a reflected cross‑site scripting flaw. When a user requests a specially crafted URL or form submission, the input is incorporated into the generated web page without proper sanitization, causing malicious scripts to run in the victim’s browser. This flaw can allow the execution of arbitrary JavaScript in the context of the website.

Affected Systems

CreativeMindsSolutions supplies the WordPress CM Map Locations plugin. Versions from the initial release up to and including 2.0.8 are susceptible to the reflected XSS vulnerability, meaning any WordPress site that has an affected version installed is at risk.

Risk and Exploitability

The CVSS score of 7.1 signals a moderate‑to‑high impact vulnerability. The EPSS score is less than 1%, indicating a very low but not zero probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to provide a crafted link or input that a user clicks or submits, resulting in the browser executing malicious code.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

CreativeMindsSolutions

CM Map Locations

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.0.8

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the CM Map Locations plugin to a fixed version once a vendor‑provided patch is released.
Disable or delete the plugin if it is not required for site functionality.
Ensure that any user‑generated content rendered by the plugin is properly HTML‑escaped or otherwise sanitized to prevent injected scripts, in accordance with CWE‑79 best practices.

Generated by OpenCVE AI on May 2, 2026 at 03:52 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-5660	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations allows Reflected XSS. This issue affects CM Map Locations: from n/a through 2.0.8.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.393% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/cm-map-locations/vulnerability/wordpress-cm-map-locations-plugin-2-0-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations allows Reflected XSS. This issue affects CM Map Locations: from n/a through 2.0.8.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through <= 2.0.8.
References	https://patchstack.com/database/wordpress/plugin/cm-map-locations/vulnerability/wordpress-cm-map-locations-plugin-2-0-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/cm-map-locations/vulnerability/wordpress-cm-map-locations-plugin-2-0-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Mar 4, 2025 3:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 3, 2025 1:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations allows Reflected XSS. This issue affects CM Map Locations: from n/a through 2.0.8.
Title		WordPress CM Map Locations plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/cm-map-locations/vulnerability/wordpress-cm-map-locations-plugin-2-0-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`