The vulnerability CVE-2025-23794 in the _rccoder_ wp_amaps plugin allows stored cross-site scripting due to improper input neutralization during web page generation. This can enable an attacker with low privileges to inject malicious scripts that execute when a user views the affected page. The issue affects all versions up to 1.7. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation could lead to execution of arbitrary scripts in the context of the affected site, potentially allowing data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The impact is limited by the requirement for user interaction and low privileges needed by the attacker. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — no official patch or vendor advisory is currently available. Users should monitor the vendor's communications for updates and apply any forthcoming patches promptly. Until a fix is released, consider restricting access to the plugin features or disabling the plugin if feasible to reduce exposure.