Skip to main content

CVE-2025-5122: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in goiblas Map Block Leaflet

Medium
VulnerabilityCVE-2025-5122cvecve-2025-5122cwe-79
Published: Thu May 29 2025 (05/29/2025, 08:22:02 UTC)
Source: CVE Database V5
Vendor/Project: goiblas
Product: Map Block Leaflet

Description

The Map Block Leaflet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AI-Powered Analysis

AILast updated: 07/07/2025, 04:43:17 UTC

Technical Analysis

CVE-2025-5122 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Map Block Leaflet plugin for WordPress, developed by goiblas. This vulnerability exists in all versions up to and including 3.2.1 due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'url' parameter. An authenticated attacker with Contributor-level access or higher can exploit this flaw by injecting malicious JavaScript code into pages via the vulnerable parameter. When other users access these pages, the injected scripts execute in their browsers, potentially leading to session hijacking, privilege escalation, or redirection to malicious sites. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level. It requires network access, low attack complexity, and privileges (Contributor or above), but no user interaction is needed for exploitation. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable plugin, potentially impacting the entire WordPress site. No known exploits are currently reported in the wild, and no official patches have been released yet. The root cause is a failure to properly sanitize and escape user-supplied input before rendering it in web pages, a classic CWE-79 issue. This vulnerability is particularly dangerous in multi-user WordPress environments where contributors can add or edit content, as it allows persistent script injection affecting all visitors to the compromised pages.

Potential Impact

For European organizations using WordPress sites with the Map Block Leaflet plugin, this vulnerability poses a significant risk to website integrity and user trust. Exploitation could lead to unauthorized script execution in visitors' browsers, enabling theft of authentication cookies, defacement, or redirection to phishing or malware sites. This can damage brand reputation, cause data breaches involving user credentials or personal data, and potentially lead to regulatory non-compliance under GDPR if personal data is compromised. The medium severity score reflects that while the vulnerability requires authenticated access, many organizations allow contributors or similar roles, increasing the attack surface. The scope change means the impact could extend beyond the plugin to the entire WordPress installation, potentially affecting site availability and integrity. European organizations with public-facing websites relying on this plugin, especially those in sectors like e-commerce, government, education, and media, are at heightened risk due to the potential for widespread user impact and regulatory scrutiny.

Mitigation Recommendations

Organizations should immediately audit their WordPress installations to identify the presence of the Map Block Leaflet plugin and its version. Until an official patch is released, restrict Contributor-level and higher access to trusted users only, and review existing content for suspicious scripts or injected code. Implement Web Application Firewall (WAF) rules to detect and block malicious payloads targeting the 'url' parameter in plugin requests. Employ Content Security Policy (CSP) headers to limit the execution of unauthorized scripts on affected sites. Regularly monitor logs for unusual activity or unauthorized content changes. Once a patch is available, prioritize prompt updating of the plugin. Additionally, consider isolating or disabling the plugin temporarily if feasible. Educate content contributors about the risks of injecting untrusted URLs or scripts and enforce strict input validation policies at the application level. Finally, conduct security assessments and penetration testing focused on XSS vulnerabilities in WordPress environments to proactively identify and remediate similar issues.

Need more detailed analysis?Get Pro

Technical Details

Data Version
5.1
Assigner Short Name
Wordfence
Date Reserved
2025-05-23T17:18:43.336Z
Cvss Version
3.1
State
PUBLISHED

Threat ID: 68381aae182aa0cae273c2cb

Added to database: 5/29/2025, 8:28:30 AM

Last enriched: 7/7/2025, 4:43:17 AM

Last updated: 7/30/2025, 4:10:52 PM

Views: 10

Actions

PRO

Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.

Please log in to the Console to use AI analysis features.

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats