CVE-2025-5122: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in goiblas Map Block Leaflet
The Map Block Leaflet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AI Analysis
Technical Summary
CVE-2025-5122 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Map Block Leaflet plugin for WordPress, developed by goiblas. This vulnerability exists in all versions up to and including 3.2.1 due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'url' parameter. An authenticated attacker with Contributor-level access or higher can exploit this flaw by injecting malicious JavaScript code into pages via the vulnerable parameter. When other users access these pages, the injected scripts execute in their browsers, potentially leading to session hijacking, privilege escalation, or redirection to malicious sites. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level. It requires network access, low attack complexity, and privileges (Contributor or above), but no user interaction is needed for exploitation. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable plugin, potentially impacting the entire WordPress site. No known exploits are currently reported in the wild, and no official patches have been released yet. The root cause is a failure to properly sanitize and escape user-supplied input before rendering it in web pages, a classic CWE-79 issue. This vulnerability is particularly dangerous in multi-user WordPress environments where contributors can add or edit content, as it allows persistent script injection affecting all visitors to the compromised pages.
Potential Impact
For European organizations using WordPress sites with the Map Block Leaflet plugin, this vulnerability poses a significant risk to website integrity and user trust. Exploitation could lead to unauthorized script execution in visitors' browsers, enabling theft of authentication cookies, defacement, or redirection to phishing or malware sites. This can damage brand reputation, cause data breaches involving user credentials or personal data, and potentially lead to regulatory non-compliance under GDPR if personal data is compromised. The medium severity score reflects that while the vulnerability requires authenticated access, many organizations allow contributors or similar roles, increasing the attack surface. The scope change means the impact could extend beyond the plugin to the entire WordPress installation, potentially affecting site availability and integrity. European organizations with public-facing websites relying on this plugin, especially those in sectors like e-commerce, government, education, and media, are at heightened risk due to the potential for widespread user impact and regulatory scrutiny.
Mitigation Recommendations
Organizations should immediately audit their WordPress installations to identify the presence of the Map Block Leaflet plugin and its version. Until an official patch is released, restrict Contributor-level and higher access to trusted users only, and review existing content for suspicious scripts or injected code. Implement Web Application Firewall (WAF) rules to detect and block malicious payloads targeting the 'url' parameter in plugin requests. Employ Content Security Policy (CSP) headers to limit the execution of unauthorized scripts on affected sites. Regularly monitor logs for unusual activity or unauthorized content changes. Once a patch is available, prioritize prompt updating of the plugin. Additionally, consider isolating or disabling the plugin temporarily if feasible. Educate content contributors about the risks of injecting untrusted URLs or scripts and enforce strict input validation policies at the application level. Finally, conduct security assessments and penetration testing focused on XSS vulnerabilities in WordPress environments to proactively identify and remediate similar issues.
Affected Countries
Germany, France, United Kingdom, Netherlands, Italy, Spain, Poland, Sweden
CVE-2025-5122: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in goiblas Map Block Leaflet
Description
The Map Block Leaflet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AI-Powered Analysis
Technical Analysis
CVE-2025-5122 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Map Block Leaflet plugin for WordPress, developed by goiblas. This vulnerability exists in all versions up to and including 3.2.1 due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'url' parameter. An authenticated attacker with Contributor-level access or higher can exploit this flaw by injecting malicious JavaScript code into pages via the vulnerable parameter. When other users access these pages, the injected scripts execute in their browsers, potentially leading to session hijacking, privilege escalation, or redirection to malicious sites. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level. It requires network access, low attack complexity, and privileges (Contributor or above), but no user interaction is needed for exploitation. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable plugin, potentially impacting the entire WordPress site. No known exploits are currently reported in the wild, and no official patches have been released yet. The root cause is a failure to properly sanitize and escape user-supplied input before rendering it in web pages, a classic CWE-79 issue. This vulnerability is particularly dangerous in multi-user WordPress environments where contributors can add or edit content, as it allows persistent script injection affecting all visitors to the compromised pages.
Potential Impact
For European organizations using WordPress sites with the Map Block Leaflet plugin, this vulnerability poses a significant risk to website integrity and user trust. Exploitation could lead to unauthorized script execution in visitors' browsers, enabling theft of authentication cookies, defacement, or redirection to phishing or malware sites. This can damage brand reputation, cause data breaches involving user credentials or personal data, and potentially lead to regulatory non-compliance under GDPR if personal data is compromised. The medium severity score reflects that while the vulnerability requires authenticated access, many organizations allow contributors or similar roles, increasing the attack surface. The scope change means the impact could extend beyond the plugin to the entire WordPress installation, potentially affecting site availability and integrity. European organizations with public-facing websites relying on this plugin, especially those in sectors like e-commerce, government, education, and media, are at heightened risk due to the potential for widespread user impact and regulatory scrutiny.
Mitigation Recommendations
Organizations should immediately audit their WordPress installations to identify the presence of the Map Block Leaflet plugin and its version. Until an official patch is released, restrict Contributor-level and higher access to trusted users only, and review existing content for suspicious scripts or injected code. Implement Web Application Firewall (WAF) rules to detect and block malicious payloads targeting the 'url' parameter in plugin requests. Employ Content Security Policy (CSP) headers to limit the execution of unauthorized scripts on affected sites. Regularly monitor logs for unusual activity or unauthorized content changes. Once a patch is available, prioritize prompt updating of the plugin. Additionally, consider isolating or disabling the plugin temporarily if feasible. Educate content contributors about the risks of injecting untrusted URLs or scripts and enforce strict input validation policies at the application level. Finally, conduct security assessments and penetration testing focused on XSS vulnerabilities in WordPress environments to proactively identify and remediate similar issues.
Affected Countries
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-05-23T17:18:43.336Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 68381aae182aa0cae273c2cb
Added to database: 5/29/2025, 8:28:30 AM
Last enriched: 7/7/2025, 4:43:17 AM
Last updated: 7/30/2025, 4:10:52 PM
Views: 10
Related Threats
CVE-2025-8975: Cross Site Scripting in givanz Vvveb
MediumCVE-2025-55716: CWE-862 Missing Authorization in VeronaLabs WP Statistics
MediumCVE-2025-55714: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crocoblock JetElements For Elementor
MediumCVE-2025-55713: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in CreativeThemes Blocksy
MediumCVE-2025-55712: CWE-862 Missing Authorization in POSIMYTH The Plus Addons for Elementor Page Builder Lite
MediumActions
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.