CVE-2025-23518

CVE-2025-23518 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the GoogleMapper WordPress plugin (googlemapper-2) developed by mrsaucier. This issue affects all versions of the plugin from its initial release through 2.0.3.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable over the network with low attack complexity, no required privileges, but user interaction such as visiting a malicious link. Remote attackers can inject and execute arbitrary scripts in the context of the affected site, achieving low impacts on confidentiality, integrity, and availability within a changed security scope.

Patchstack advisories document this Cross-site Scripting vulnerability in GoogleMapper 2.0.3 and provide details on affected WordPress plugin instances, urging practitioners to consult the database entry at https://patchstack.com/database/Wordpress/Plugin/googlemapper-2/vulnerability/wordpress-googlemapper-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve for mitigation guidance, such as applying available updates.