CVE-2025-13364 is a stored cross-site scripting vulnerability in the WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters WordPress plugin. The flaw exists due to improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of user-supplied attributes in the 'put_wpgm' shortcode. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of any user viewing the compromised page. The vulnerability affects all versions up to and including 4.8.7. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who view the infected pages, potentially leading to data theft, session hijacking, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting contributor-level access and above to trusted users only. Monitor plugin updates from the vendor and apply any released patches promptly. Avoid using the vulnerable shortcode with untrusted input.