免费扫描

此页面尚未翻译为您的语言。我们正在努力翻译，目前显示英文内容。

💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.

MEDIUMCVE-2025-15345CVSS 6.1

CVE-2025-15345: XSS in MapGeo – Interactive Geo Maps

平台

wordpress

组件

interactive-geo-maps

修复版本

1.6.28

在NVD查看
保存
正在翻译为您的语言…

CVE-2025-15345 identifies a Reflected Cross-Site Scripting (XSS) vulnerability affecting the MapGeo – Interactive Geo Maps plugin for WordPress. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages. The issue impacts versions 1.0.0 through 1.6.27, and a patch is available in version 1.6.28.

WordPress

检测此 CVE 是否影响你的项目

上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。

免费扫描

影响与攻击场景翻译中…

Successful exploitation of CVE-2025-15345 allows an attacker to execute malicious JavaScript code within the context of a user's browser. This can lead to various consequences, including session hijacking, credential theft, and defacement of the affected WordPress site. Attackers could craft malicious links containing the injected script and trick users into clicking them, leading to the execution of the attacker's code. The impact is amplified if the website handles sensitive user data or financial transactions, as attackers could potentially steal this information. This vulnerability shares similarities with other XSS vulnerabilities where user input is not properly sanitized before being displayed, leading to code injection.

利用背景翻译中…

CVE-2025-15345 was published on 2026-05-14. Its severity is currently assessed as Medium (CVSS 6.1). No public Proof-of-Concept (POC) exploits have been publicly disclosed at the time of writing, but the vulnerability's nature makes it likely that such exploits will emerge. There are no indications of active exploitation campaigns targeting this vulnerability at this time. Refer to the WordPress security advisory for further details.

威胁情报

漏洞利用状态

概念验证未知
CISA KEVNO
互联网暴露高

CISA SSVC

利用情况none
可自动化no
技术影响partial

CVSS 向量

威胁情报· CVSS 3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N6.1MEDIUMAttack VectorNetwork攻击者如何到达目标Attack ComplexityLow利用漏洞所需的条件Privileges RequiredNone攻击所需的认证级别User InteractionRequired是否需要受害者采取行动ScopeChanged超出受影响组件的影响范围ConfidentialityLow敏感数据泄露风险IntegrityLow数据未授权篡改风险AvailabilityNone服务中断风险nextguardhq.com · CVSS v3.1 基础分数
这些指标意味着什么？
Attack Vector
网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
Attack Complexity
低 — 无需特殊条件，可以稳定地利用漏洞。
Privileges Required
无 — 无需认证，无需凭证即可利用。
User Interaction
需要 — 受害者必须打开文件、点击链接或访问特制页面。
Scope
已改变 — 攻击可以超出脆弱组件，影响其他系统。
Confidentiality
低 — 可访问部分数据。
Integrity
低 — 攻击者可修改部分数据，影响有限。
Availability
无 — 无可用性影响。

受影响的软件

组件interactive-geo-maps
供应商wordfence
最低版本1.0.0
最高版本1.6.27
修复版本1.6.28

弱点分类 (CWE)

CWE-80

时间线

  1. 已保留
  2. 发布日期

缓解措施和替代方案翻译中…

The primary mitigation for CVE-2025-15345 is to immediately upgrade the MapGeo – Interactive Geo Maps plugin to version 1.6.28 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious characters in the 'map' parameter. Additionally, carefully review any user input used in the display-map shortcode and ensure proper input sanitization and output escaping are implemented. Regularly scan your WordPress installation for vulnerable plugins using security scanning tools.

修复方法

更新至 1.6.28 版本，或更新的修复版本

常见问题翻译中…

What is CVE-2025-15345 — XSS in MapGeo – Interactive Geo Maps?

CVE-2025-15345 is a Reflected Cross-Site Scripting (XSS) vulnerability in the MapGeo WordPress plugin, allowing attackers to inject malicious scripts via the 'map' parameter. It affects versions 1.0.0 through 1.6.27.

Am I affected by CVE-2025-15345 in MapGeo – Interactive Geo Maps?

You are affected if you are using the MapGeo plugin in WordPress versions 1.0.0 to 1.6.27. Check your plugin version immediately and upgrade if necessary.

How do I fix CVE-2025-15345 in MapGeo – Interactive Geo Maps?

Upgrade the MapGeo plugin to version 1.6.28 or later to resolve the vulnerability. Consider implementing a WAF rule as a temporary mitigation if immediate upgrade is not possible.

Is CVE-2025-15345 being actively exploited?

There are currently no public reports of active exploitation campaigns targeting CVE-2025-15345, but the vulnerability's nature makes it a potential target.

Where can I find the official MapGeo advisory for CVE-2025-15345?

Refer to the WordPress security advisory and the MapGeo plugin's official website for the latest information and updates regarding CVE-2025-15345.

你的项目受影响吗?

上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。

免费扫描搜索 CVE
WordPress

检测此 CVE 是否影响你的项目

上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。

免费扫描
live免费扫描

立即扫描您的WordPress项目 — 无需账户

上传任何清单文件 (composer.lock, package-lock.json, WordPress 插件列表…) 或粘贴您的组件列表。您立即获得一份漏洞报告。上传文件只是开始：拥有账户后，您将获得持续监控、Slack/电子邮件警报、多项目和白标报告。

手动扫描Slack/邮件提醒持续监控白标报告

拖放您的依赖文件

composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...