CVE-2025-23594

CVE-2025-23594 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Google Map With Fancybox WordPress plugin developed by Uzzal Mondal and referred to as location-piker. This issue affects all versions of the plugin from unknown initial release through 2.1.0.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Remote attackers can exploit it by injecting malicious scripts via reflected input, achieving limited impacts on confidentiality, integrity, and availability within the victim's browser context due to the changed scope.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/location-piker/vulnerability/wordpress-google-map-with-fancybox-plugin-2-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the vulnerability in this WordPress plugin. Security practitioners should consult it for specific mitigation guidance.