CVE-2025-32179: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in icopydoc Maps for WP plugin versions through 1.2.4. The vulnerability was reported on December 21, 2024, and publicly disclosed on April 4, 2025. This security issue affects WordPress installations using the Maps for WP plugin and requires Contributor or higher privileges to exploit (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires low attack complexity but needs user interaction and low privileges to exploit (NVD, Patchstack).

This vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site. The impact is considered to have low severity but could affect website functionality and user experience (Patchstack).

The vulnerability has been fixed in version 1.2.5 of the Maps for WP plugin. Users are advised to update to version 1.2.5 or later to remove the vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).