CVE-2025-2055

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.8MEDIUM
EPSS
0.3%
top 43.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Mappress Maps FOR WordpressMappresspro Mappress
Timeline
PublishedApr 3

Description

The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HExploitability: 0.9 | Impact: 5.9

Affected Packages2 packages

▶NVDmappresspro/mappress< 2.94.9

🔴Vulnerability Details

2
CVEList
MapPress Maps for WordPress < 2.94.9 - Contributor+ Stored XSS↗2025-04-03
▶
GHSA
GHSA-wh3v-xmpm-9x73: The MapPress Maps for WordPress plugin before 2↗2025-04-03
▶
CVE-2025-2055 (MEDIUM CVSS 6.8) | The MapPress Maps for WordPress plu | cvebase.io