Esta página aún no ha sido traducida a tu idioma. Mostrando contenido en inglés mientras trabajamos en ello.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2025-15345: XSS in MapGeo – Interactive Geo Maps
Plataforma
wordpress
Componente
interactive-geo-maps
Corregido en
1.6.28
CVE-2025-15345 identifies a Reflected Cross-Site Scripting (XSS) vulnerability affecting the MapGeo – Interactive Geo Maps plugin for WordPress. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages. The issue impacts versions 1.0.0 through 1.6.27, and a patch is available in version 1.6.28.
Detecta esta CVE en tu proyecto
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Impacto y Escenarios de Ataquetraduciendo…
Successful exploitation of CVE-2025-15345 allows an attacker to execute malicious JavaScript code within the context of a user's browser. This can lead to various consequences, including session hijacking, credential theft, and defacement of the affected WordPress site. Attackers could craft malicious links containing the injected script and trick users into clicking them, leading to the execution of the attacker's code. The impact is amplified if the website handles sensitive user data or financial transactions, as attackers could potentially steal this information. This vulnerability shares similarities with other XSS vulnerabilities where user input is not properly sanitized before being displayed, leading to code injection.
Contexto de Explotacióntraduciendo…
CVE-2025-15345 was published on 2026-05-14. Its severity is currently assessed as Medium (CVSS 6.1). No public Proof-of-Concept (POC) exploits have been publicly disclosed at the time of writing, but the vulnerability's nature makes it likely that such exploits will emerge. There are no indications of active exploitation campaigns targeting this vulnerability at this time. Refer to the WordPress security advisory for further details.
Inteligencia de Amenazas
Estado del Exploit
CISA SSVC
Vector CVSS
¿Qué significan estas métricas?
- Attack Vector
- Red — explotable remotamente por internet. Sin acceso físico ni local. Mayor superficie de ataque.
- Attack Complexity
- Baja — sin condiciones especiales. El atacante puede explotar de forma confiable sin configuraciones raras.
- Privileges Required
- Ninguno — sin autenticación. No se necesitan credenciales para explotar.
- User Interaction
- Requerida — la víctima debe abrir un archivo, hacer clic en un enlace o visitar una página.
- Scope
- Cambiado — el ataque puede pivotar a otros sistemas más allá del componente vulnerable.
- Confidentiality
- Bajo — acceso parcial o indirecto a algunos datos.
- Integrity
- Bajo — el atacante puede modificar algunos datos con alcance limitado.
- Availability
- Ninguno — sin impacto en disponibilidad.
Software Afectado
Clasificación de Debilidad (CWE)
Cronología
- Reservado
- Publicada
Mitigación y Workaroundstraduciendo…
The primary mitigation for CVE-2025-15345 is to immediately upgrade the MapGeo – Interactive Geo Maps plugin to version 1.6.28 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious characters in the 'map' parameter. Additionally, carefully review any user input used in the display-map shortcode and ensure proper input sanitization and output escaping are implemented. Regularly scan your WordPress installation for vulnerable plugins using security scanning tools.
Cómo corregirlo
Actualizar a la versión 1.6.28, o una versión parcheada más reciente
Preguntas frecuentestraduciendo…
What is CVE-2025-15345 — XSS in MapGeo – Interactive Geo Maps?
CVE-2025-15345 is a Reflected Cross-Site Scripting (XSS) vulnerability in the MapGeo WordPress plugin, allowing attackers to inject malicious scripts via the 'map' parameter. It affects versions 1.0.0 through 1.6.27.
Am I affected by CVE-2025-15345 in MapGeo – Interactive Geo Maps?
You are affected if you are using the MapGeo plugin in WordPress versions 1.0.0 to 1.6.27. Check your plugin version immediately and upgrade if necessary.
How do I fix CVE-2025-15345 in MapGeo – Interactive Geo Maps?
Upgrade the MapGeo plugin to version 1.6.28 or later to resolve the vulnerability. Consider implementing a WAF rule as a temporary mitigation if immediate upgrade is not possible.
Is CVE-2025-15345 being actively exploited?
There are currently no public reports of active exploitation campaigns targeting CVE-2025-15345, but the vulnerability's nature makes it a potential target.
Where can I find the official MapGeo advisory for CVE-2025-15345?
Refer to the WordPress security advisory and the MapGeo plugin's official website for the latest information and updates regarding CVE-2025-15345.
¿Tu proyecto está afectado?
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Detecta esta CVE en tu proyecto
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Escanea tu proyecto WordPress ahora — sin cuenta
Sube cualquier manifiesto (composer.lock, package-lock.json, lista de plugins WordPress…) o pega tu lista de componentes. Recibís un reporte de vulnerabilidades al instante. Subir un archivo es solo el primer paso: con una cuenta tenés monitoreo continuo, alertas en tu canal, multi-proyecto y reportes white-label.
Arrastra y suelta tu archivo de dependencias
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...