CVE-2025-8568 is a stored cross-site scripting vulnerability in the prabode GMap Generator WordPress plugin affecting all versions up to and including 1.1. The vulnerability is due to improper neutralization of input during web page generation, specifically through the 'h' parameter. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary web scripts that execute in the context of users viewing the compromised pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an authenticated contributor or higher to inject malicious scripts that execute in other users' browsers when they access the injected page. This can lead to unauthorized disclosure of information and modification of content within the affected site context. There is no indication of availability impact. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the GMap Generator plugin if possible. Monitor for updates from the vendor or security community regarding patches or workarounds.