CVE-2025-7660: 
WordPress vulnerability analysis and mitigation

CVE-2025-7660 is a Stored Cross-Site Scripting (XSS) vulnerability in the Map My Locations plugin for WordPress, affecting all versions up to and including 1.1. The flaw exists in the plugin's map_my_locations shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on July 18, 2025, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). Authenticated attackers with contributor-level access or above can embed malicious JavaScript payloads within the map_my_locations shortcode attributes in WordPress posts or pages. Because the plugin fails to sanitize input or escape output before rendering, the injected script is stored server-side and executes in the browser of any user who visits the affected page. The vulnerable code paths are located in public/class-map-my-locations-public.php and public/partials/map-my-locations-public-display.php (Wordfence, ENISA EUVD).

Successful exploitation allows an attacker to inject persistent malicious scripts that execute in the context of any user's browser when they visit an affected page, impacting both confidentiality and integrity (CVSS C:L/I:L). Potential consequences include session cookie theft, credential harvesting, defacement of page content, and redirection of users to malicious sites. While availability is not directly impacted, the stored nature of the attack means a single injection can affect all site visitors until the payload is removed (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum contributor-level authentication on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Map My Locations plugin version 1.1 or earlier, using tools like WPScan or by checking the plugin's readme.txt file at wp-content/plugins/map-my-locations/readme.txt.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Create or edit a post: Navigate to the WordPress editor and create or edit a post/page where the map_my_locations shortcode can be inserted.
4. Inject malicious payload: Insert the shortcode with a crafted attribute containing a JavaScript payload, for example: [map_my_locations attribute="\"onmouseover=\"alert(document.cookie)"] or a similar XSS vector targeting unsanitized shortcode attributes.
5. Publish the page: Submit or update the post so the malicious shortcode is stored in the database.
6. Trigger execution: When any authenticated or unauthenticated user visits the page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing shortcode content with encoded JavaScript (e.g., <script>, onerror=, onmouseover=, javascript:).
• Database: Unexpected JavaScript payloads stored in the wp_posts table within map_my_locations shortcode attributes.
• File System: Modifications to plugin files public/class-map-my-locations-public.php or public/partials/map-my-locations-public-display.php that may indicate tampering beyond the stored XSS payload.
• Network: Outbound requests from victim browsers to unknown external domains (e.g., for cookie exfiltration) originating from pages containing the map_my_locations shortcode.

The primary remediation is to update the Map My Locations plugin beyond version 1.1 once a patched release is made available by the vendor (lewisking0072). Until a patch is released, administrators should disable or remove the plugin entirely. Site administrators should also audit existing posts and pages for any map_my_locations shortcode usage and review the stored content for injected scripts. Restricting contributor-level user registration and enforcing the principle of least privilege can reduce the attack surface (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for July 14–20, 2025, and published the advisory through their threat intelligence platform. No significant independent researcher commentary, vendor statements beyond the initial disclosure, or notable media coverage has been identified for this vulnerability (Wordfence Weekly Report).