Atomic Edge analysis of CVE-2025-67990 (metadata-based):
This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the GMap Targeting WordPress plugin, affecting versions up to and including 1.1.7. The flaw allows attackers to inject malicious scripts that execute automatically when a user visits a compromised page. The CVSS score of 7.2 (High) reflects its network-based attack vector, low attack complexity, and scope change impact.

Atomic Edge research infers the root cause is insufficient input sanitization and output escaping, as defined by CWE-79. The vulnerability description confirms a lack of proper neutralization for user-supplied input before it is stored and rendered on a web page. Without access to the source code diff, this conclusion is based on the standard WordPress security failure pattern where user input reaches a database or file without validation and is later echoed to the browser without escaping functions like `esc_html` or `esc_attr`.

Exploitation likely targets a public-facing plugin feature that accepts and stores user input. A probable attack vector is a plugin shortcode or front-end form handler that processes parameters like map markers, titles, or descriptions. An attacker would send a POST or GET request containing a crafted JavaScript payload, such as `alert(document.domain)`, to a plugin-specific endpoint. This endpoint could be a WordPress AJAX handler (`/wp-admin/admin-ajax.php`) with an action parameter like `gmap_targeting_save`, or a public-facing form submission handler.

Remediation requires implementing proper input validation and output escaping. The patched version (1.1.8) likely added sanitization functions like `sanitize_text_field` for input and escaping functions like `esc_html` or `wp_kses` for output. For data intended to contain HTML, the plugin should use `wp_kses_post` to allow only safe tags. WordPress nonce verification and capability checks should also be present to restrict unauthorized access, though the unauthenticated nature suggests these were also missing.

Successful exploitation leads to stored XSS, where malicious scripts execute in the victim’s browser under the context of the vulnerable WordPress site. This allows attackers to steal session cookies, perform actions as the victim user, deface websites, or redirect users to malicious domains. The CVSS vector indicates impacts on confidentiality and integrity, with a changed scope meaning the attack can affect other site components beyond the plugin’s own security context.