CVE-2025-13846: 
WordPress vulnerability analysis and mitigation

CVE-2025-13846 is a Stored Cross-Site Scripting (XSS) vulnerability in the Easy Map Creator plugin for WordPress, affecting all versions up to and including 3.0.2. The flaw exists in the width parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or higher to inject persistent malicious scripts into pages. It was published on December 12, 2025, and assigned by Wordfence. The CVSS v3.1 base score is 6.4 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The root cause is the failure to sanitize user-supplied input in the width parameter and the lack of proper output escaping when rendering the value in generated pages. An authenticated attacker with at least Contributor-level WordPress access can craft a malicious shortcode or map embed containing a JavaScript payload in the width field; this payload is stored in the database and executed in the browser of any user who visits the affected page. The vulnerable code path is visible in the plugin source at line 139 of easy_map_creator.php (Wordfence, WordPress Trac).

Successful exploitation allows injected scripts to execute in the browsers of all site visitors who access a compromised page, enabling session hijacking, credential theft, redirection to malicious sites, or defacement. Because the payload is stored server-side, every subsequent page visit triggers execution without further attacker interaction. The scope is changed (affecting users beyond the attacker's own session), with low confidentiality and integrity impact and no direct availability impact (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13846 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running Easy Map Creator ≤ 3.0.2.
2. Create or Edit a Post: Navigate to the WordPress editor and insert an Easy Map Creator shortcode or block that accepts a width parameter.
3. Inject Malicious Payload: Set the width parameter to a crafted value containing a JavaScript payload, e.g., width="1\" onmouseover=\"alert(document.cookie) or an equivalent attribute-breaking XSS string.
4. Publish the Content: Save and publish the post or page; the unsanitized value is stored in the WordPress database.
5. Trigger Execution: When any site visitor (including administrators) loads the affected page, the injected script executes in their browser, enabling session token theft, phishing overlays, or further malicious actions (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing unusual values in map-related parameters (e.g., width fields with HTML/JavaScript content; look for <script>, onerror=, onmouseover=, or encoded equivalents).
• Database: Unexpected JavaScript or HTML event handler strings stored in wp_posts or wp_postmeta tables associated with Easy Map Creator shortcodes or blocks.
• File System: No direct file-system artifacts expected for a stored XSS; however, check for newly created or modified posts/pages containing map embeds with anomalous width values.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from pages hosting Easy Map Creator content.

At the time of disclosure, no patched version beyond 3.0.2 was confirmed available; site administrators should monitor the WordPress plugin repository for an updated release from the vendor (qrevo) that addresses the sanitization issue. As an immediate workaround, disable or remove the Easy Map Creator plugin until a fix is released. Additionally, restrict Contributor-level account creation and review existing Contributor accounts for unauthorized access. Implementing a Web Application Firewall (WAF) rule to block XSS payloads in plugin parameters can provide an additional layer of defense (Wordfence, Wordfence Weekly Report).

Wordfence disclosed and assigned this CVE as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting the stored XSS risk to all site visitors. No significant independent researcher commentary or broader media coverage has been identified beyond the initial Wordfence advisory (Wordfence Weekly Report).