CVE-2025-9123 is a stored cross-site scripting vulnerability in the CBX Map for Google Map & OpenStreetMap WordPress plugin by manchumahara. The vulnerability affects all versions up to and including 2.0.1. It allows authenticated users with Contributor-level privileges or higher to inject malicious scripts via the popup heading and location address parameters due to improper input neutralization and output escaping. These scripts execute in the context of users who visit the injected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, and privileges required. No patch or remediation details have been provided.

Exploitation of this vulnerability allows an authenticated attacker with Contributor-level access or above to inject and store malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the plugin if possible. Monitor vendor channels for updates regarding patches or official mitigations.