CVE-2025-15345 is a reflected XSS vulnerability in the MapGeo – Interactive Geo Maps WordPress plugin affecting all versions up to 1.6.27. The issue stems from improper neutralization of script-related HTML tags (CWE-80) in the 'map' parameter of the display-map shortcode. Attackers can inject malicious scripts that execute in the context of users who click on crafted links, potentially leading to information disclosure or session hijacking. The vulnerability requires user interaction and does not require privileges to exploit.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a victim's browser when they interact with a maliciously crafted link. This can lead to limited confidentiality and integrity impacts such as theft of session cookies or manipulation of displayed content. There is no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the plugin if feasible. Additionally, applying web application firewall (WAF) rules that detect and block reflected XSS attempts targeting the 'map' parameter may reduce risk. Educate users to avoid clicking suspicious links related to affected sites.