CVE-2025-57952 is a stored cross-site scripting vulnerability in the icopydoc Maps for WP WordPress plugin versions up to 1.2.5. It results from improper input neutralization during web page generation, enabling attackers with high privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 score of 5.9, reflecting medium severity with network attack vector, low attack complexity, required privileges, and user interaction. The impact includes limited confidentiality, integrity, and availability loss. No vendor advisory or patch information is currently available, and no known active exploitation has been reported.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute when other users view affected pages, potentially leading to limited data disclosure, modification, or disruption of service. The impact is rated medium severity with partial confidentiality, integrity, and availability loss. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is available, users should monitor the vendor's communications for updates. Until a fix is released, limiting administrative access and exercising caution with user input may reduce risk.