CVE-2025-2162
📋 TL;DR
The MapPress Maps for WordPress plugin before version 2.94.10 contains a stored cross-site scripting (XSS) vulnerability in plugin settings. This allows authenticated administrators to inject malicious scripts that execute when other users view affected pages, even in WordPress multisite installations where unfiltered_html is restricted. Only WordPress sites using vulnerable MapPress versions are affected.
💻 Affected Systems
- MapPress Maps for WordPress
📦 What is this software?
Mappress by Mappresspro
⚠️ Risk & Real-World Impact
Worst Case
An attacker with admin privileges could inject malicious JavaScript that steals session cookies, redirects users to phishing sites, or performs actions on behalf of authenticated users, potentially leading to complete site compromise.
Likely Case
Malicious admin injects scripts that affect other users viewing plugin settings pages, potentially stealing credentials or performing unauthorized actions.
If Mitigated
With proper user access controls and input validation, impact is limited to admin-only areas with minimal effect on regular users.
🎯 Exploit Status
Exploitation requires admin privileges. No public exploit code identified at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.94.10
Vendor Advisory: https://wpscan.com/vulnerability/06063788-7ab8-49cc-9911-1d9926fcf99d/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find MapPress Maps for WordPress. 4. Click 'Update Now' if available. 5. Alternatively, download version 2.94.10+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Remove Admin Access
allTemporarily restrict admin privileges to trusted users only until patch is applied.
Disable Plugin
linuxDeactivate MapPress plugin if not essential for site functionality.
wp plugin deactivate mappress-google-maps-for-wordpress
🧯 If You Can't Patch
- Implement strict user access controls and monitor admin activity
- Deploy web application firewall with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → MapPress Maps for WordPress → Version numberCheck Version:
wp plugin get mappress-google-maps-for-wordpress --field=versionVerify Fix Applied:
Confirm plugin version is 2.94.10 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual admin activity modifying plugin settings
- JavaScript injection in plugin configuration fields
Network Indicators:
- Suspicious script tags in HTTP POST requests to admin-ajax.php or plugin settings pages
SIEM Query:
source="wordpress.log" AND "mappress" AND ("update_option" OR "plugin_settings")