CVE-2025-11307: 
WordPress Analyse et atténuation des vulnérabilités

The WP Go Maps (formerly WP Google Maps) WordPress plugin before version 9.0.48 contains a security vulnerability identified as CVE-2025-11307. The vulnerability was discovered by security researcher sunghoon kim and was publicly disclosed on October 21, 2025 (WPScan).

The vulnerability is classified as an Unauthenticated Stored Cross-Site Scripting (XSS) issue. The plugin fails to properly sanitize user input provided through an AJAX action, which allows unauthenticated users to store XSS payloads. These payloads can later be retrieved from another AJAX call and are output unescaped. The vulnerability has been assigned a CVSS score of 8.8 (High) and is categorized under CWE-79 (WPScan).

This vulnerability allows unauthenticated attackers to store malicious scripts that can be executed in other users' browsers when they access the affected content. As an XSS vulnerability, it could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks against WordPress site administrators or users (WPScan).

The vulnerability has been fixed in WP Go Maps version 9.0.48. Users are strongly advised to update to this version or later to protect their WordPress installations (WPScan).