CVE-2025-15345

Name of the Vulnerable Software and Affected Versions MapGeo – Interactive Geo Maps versions prior to 1.6.28

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the map parameter within the display-map shortcode, enabling the injection of arbitrary web scripts that execute when a user is tricked into clicking a malicious link.

Recommendations Update MapGeo – Interactive Geo Maps to version 1.6.28 or later. As a temporary mitigation, restrict the use of the map parameter in the display-map shortcode.