CVE-2025-14851

Name of the Vulnerable Software and Affected Versions YaMaps for WordPress plugin versions prior to 0.6.40

Description The YaMaps for WordPress plugin is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping of user-supplied attributes within the yamap shortcode parameters. This allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. When a user accesses an affected page, the injected scripts will execute. The vulnerable parameter is yamap.

Recommendations Update the YaMaps for WordPress plugin to a version later than 0.6.40.