CVE-2025-9206 is a stored cross-site scripting vulnerability in the Meks Easy Maps WordPress plugin affecting all versions up to 2.1.4. The flaw is due to improper neutralization of input during web page generation, specifically in the post title field, allowing authenticated users with contributor or higher privileges to inject arbitrary scripts. These scripts execute in the context of users viewing the map, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network exploitability with low complexity and no user interaction needed.

An attacker with contributor-level access or higher can exploit this vulnerability to inject and store malicious scripts in the post title field. These scripts execute in the browsers of users who view the affected maps, potentially leading to limited confidentiality and integrity impacts such as theft of session tokens or modification of displayed content. There is no impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the Meks Easy Maps plugin if possible. Monitor for updates from the vendor and apply patches promptly once released.