CVE-2025-9373: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in peprodev PeproDev Branches Map (Mapify)

CVE-2025-9373 is a stored cross-site scripting vulnerability in the PeproDev Branches Map (Mapify) WordPress plugin affecting versions up to 3.0.1. Authenticated attackers with Contributor-level privileges or above can inject arbitrary web scripts due to improper neutralization of input during web page generation. This vulnerability stems from inadequate input sanitization and output escaping, leading to script execution in the context of users viewing the injected pages.

Successful exploitation allows an authenticated user with Contributor or higher privileges to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or modification of page content. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates. In the meantime, restrict Contributor-level access to trusted users only and consider disabling or removing the plugin if possible. Implementing additional web application firewall (WAF) rules to detect and block XSS payloads may provide temporary mitigation.