CVE-2025-9352 is a stored cross-site scripting vulnerability (CWE-79) in the Pronamic Google Maps plugin for WordPress, affecting all versions up to and including 2.4.1. The vulnerability allows authenticated users with Contributor-level permissions or higher to inject arbitrary web scripts via the description field due to improper input neutralization during web page generation. These scripts execute when other users access the injected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 score of 5.4 reflects a medium impact with network attack vector, low attack complexity, and privileges required at the contributor level.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. There is no indication of availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access carefully and consider removing or limiting use of the Pronamic Google Maps plugin. Monitor for updates from the vendor and apply any official patches promptly once released.