CVE-2025-4131

GmapsMania <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published May 2, 2025 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The GmapsMania plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gmap shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

The GmapsMania plugin for WordPress contains a stored cross‑site scripting flaw caused by insufficient sanitization and escaping of attributes supplied to the gmap shortcode. Attackers with authenticated contributor‑level access can insert arbitrary web scripts into the shortcode. Those scripts are written to the WordPress database and then rendered unescaped whenever a user views a page that contains the shortcode. The stored XSS permits the attacker to execute client‑side code in the browsers of any visitor to the affected page.

Affected Systems

All users of the garubi GmapsMania WordPress plugin running version 1.1 or earlier are affected. The flaw is resolved in releases newer than 1.1. Sites that have not yet applied the patch or have not upgraded to a later version remain vulnerable. The vulnerability requires the attacker to have at least Contributor role or higher to add or edit content containing the shortcode.

Risk and Exploitability

The CVSS score of 6.4 reflects a moderate severity. The EPSS score is below 1 %, indicating a very low current probability of exploitation. The flaw is not listed in the CISA KEV catalog. Because the attack vector requires authenticated contributor access, the initial exploitation is limited to users with sufficient privileges. However, once a payload is stored, every visitor to the affected page will have the script executed on their browser.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

garubi

GmapsMania

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.1

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update GmapsMania to the latest version (≥ 1.2).
If an upgrade is not possible, remove or disable the gmap shortcode from all content to eliminate the vulnerability.
Restrict or revoke untrusted contributor privileges so that only trusted users can add or edit content containing shortcodes.

Generated by OpenCVE AI on April 28, 2026 at 02:04 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-12795	The GmapsMania plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gmap shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.245% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/gmapsmania/trunk/gmapsmania.php#L14
https://www.wordfence.com/threat-intel/vulnerabilities/id/30d39718-945a-43a2-be08-70be1af55965?source=cve

History

May 2, 2025 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 2, 2025 2:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The GmapsMania plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gmap shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		GmapsMania <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/browser/gmapsmania/trunk/gmapsmania.php#L14 https://www.wordfence.com/threat-intel/vulnerabilities/id/30d39718-945a-43a2-be08-70be1af55965?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`