CVE-2025-66093: 
WordPress vulnerability analysis and mitigation

CVE-2025-66093 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the "Extensions for Leaflet Map" WordPress plugin developed by hupe13. It affects all versions up to and including 4.8, with version 4.9 being the patched release. The vulnerability was reported on October 24, 2025, by researcher "zaim" and published by Patchstack on November 23, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. In DOM-Based XSS, malicious input is processed and reflected through the browser's Document Object Model without proper sanitization, allowing injected scripts to execute in the victim's browser context. Exploitation requires the attacker to have at least Contributor-level privileges on the WordPress site and also requires a privileged user to interact with crafted content (e.g., visit a malicious page or click a link). No public technical write-up or proof-of-concept code has been identified beyond the Patchstack advisory (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the browsers of users who interact with affected pages, potentially enabling session hijacking, credential theft, malicious redirects, or defacement of the affected WordPress site. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader browser context of visiting users. Confidentiality, integrity, and availability impacts are each rated Low, reflecting the limited but real risk of data exposure and content manipulation (Patchstack).

No evidence of active in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038%, indicating a very low probability of exploitation in the near term. Patchstack rates the priority as "Low" and notes it is unlikely to be exploited, though XSS vulnerabilities of this class are sometimes leveraged in mass-exploit campaigns targeting WordPress plugins at scale. No exploit kits or threat actor attribution have been identified (Patchstack).

1. Privilege Acquisition: Obtain at least Contributor-level access to the target WordPress site (e.g., via registration, credential theft, or social engineering).
2. Craft Malicious Content: Create or edit a post/page that uses the Extensions for Leaflet Map plugin shortcode or block, injecting a DOM-Based XSS payload into a vulnerable parameter (e.g., a map attribute or configuration field that is unsafely written to the DOM).
3. Deliver to Victim: Publish or share the crafted content, then social-engineer a privileged user (e.g., an administrator or editor) into visiting the page containing the malicious map element.
4. Script Execution: When the victim's browser renders the page, the injected JavaScript executes in their browser context, potentially stealing session cookies, performing actions on their behalf, or redirecting them to attacker-controlled infrastructure (Patchstack).

• Logs: WordPress access logs showing unusual POST or GET requests to pages containing Leaflet Map shortcodes with encoded or obfuscated JavaScript payloads (e.g., <script>, javascript:, onerror=, onload= patterns in parameters).
• File System: Unexpected modifications to plugin files in wp-content/plugins/extensions-leaflet-map/ or newly created PHP/JS files in the plugin directory.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with Leaflet Map content, potentially indicating data exfiltration or redirect activity.
• Browser/Application: Reports from users of unexpected redirects, pop-ups, or session anomalies when visiting pages that embed the Leaflet Map plugin.

The vendor has released version 4.9 of the Extensions for Leaflet Map plugin, which patches this vulnerability. Site administrators should update the plugin to version 4.9 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the WordPress plugin repository. If an immediate update is not possible, consider temporarily disabling the plugin or restricting Contributor-level access until the patch can be applied. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for the week of November 17–23, 2025, indicating routine tracking by the WordPress security community. No significant vendor statements, notable researcher commentary, or broader media coverage beyond standard vulnerability database listings have been identified (Wordfence Weekly Report).