CVE
CVE-2025-11307
8.8
CVSShigh
Exploitable remotely over the internet · no authentication required · user interaction needed.
Description
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped.
Attack Vector
Network
Privileges Req.
None
User Interaction
Required
wp go maps (formerly wp google maps)
Updated Nov 7, 2026View on NVD →
This CVE is in S4E's catalog, but no public scanner is mapped to it yet.
CVE history: wp go maps (formerly wp google maps)
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →