Atomic Edge analysis of CVE-2025-14851 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the YaMaps for WordPress plugin. The vulnerability exists in the plugin’s `yamap` shortcode handler, which fails to properly sanitize user-supplied shortcode attributes before output. Attackers with Contributor-level access or higher can inject malicious scripts into posts or pages. These scripts execute in the browsers of any user viewing the compromised content.

Atomic Edge research infers the root cause is insufficient input sanitization and output escaping on shortcode attributes. The CWE-79 classification confirms improper neutralization of input during web page generation. The vulnerability description states the issue occurs via the `yamap` shortcode parameters. Without a code diff, Atomic Edge analysis concludes the plugin’s shortcode callback function likely directly echoes or unsafely renders user-controlled attribute values without applying WordPress escaping functions like `esc_attr()` or `esc_html()`. This inference is based on the CWE pattern and the described attack vector.

Exploitation requires an authenticated user with at least Contributor privileges. The attacker creates or edits a post or page and inserts the `yamap` shortcode with malicious JavaScript payloads in its attributes. For example, `[yamap param=”alert(document.domain)”]`. The exact vulnerable parameter names are unspecified, but the description indicates multiple attributes are affected. The payload is stored in the post content. It executes when any visitor, including administrators, views the page where the shortcode is rendered.

Remediation requires proper output escaping on all shortcode attributes before they are printed to the browser. The patched version 0.6.41 likely added calls to WordPress core escaping functions like `esc_attr()` for HTML attributes and `wp_kses()` for any HTML content within attributes. Input sanitization functions like `sanitize_text_field()` may also have been added during shortcode attribute processing. The fix must ensure all user-controlled data is contextually escaped at the point of output.

Successful exploitation allows attackers to perform actions within the victim’s browser session. This can lead to session hijacking, administrative actions performed by administrators viewing the page, content defacement, or redirection to malicious sites. The stored nature of the attack amplifies impact, as the payload executes for every page view until removed. The CVSS vector scores a Scope change (S:C) because the vulnerability can affect users beyond the plugin’s own security scope.