Atomic Edge analysis of CVE-2025-15345:
This vulnerability is a Reflected Cross-Site Scripting (XSS) issue in the MapGeo – Interactive Geo Maps plugin for WordPress, affecting versions up to and including 1.6.27. The flaw exists in the display-map shortcode’s handling of the ‘map’ parameter, allowing an unauthenticated attacker to inject arbitrary web scripts. The issue has a CVSS score of 6.1, indicating a medium severity risk.
The root cause resides in the file interactive-geo-maps/src/Plugin/Map.php, lines 78-88 (as shown in the diff). The vulnerability occurs within the shortcode rendering logic when the ‘demo’ attribute is set. In the vulnerable code, the plugin directly used sanitize_text_field() on the $_GET[‘map’] parameter and assigned the result to the map variable without any validation that it was not a URL. Specifically, line 83 of the patched diff shows the previous code was: $main_meta[‘map’] = sanitize_text_field( $_GET[‘map’] ). This sanitization function removes tags and encodes entities, but it does not remove ‘javascript:’ URIs or other XSS vectors that can be embedded in URL-like strings. The parameter is later used in generating JavaScript for the map, making it a vector for script injection.
Exploitation requires an attacker to craft a malicious link containing the ‘map’ parameter with a payload like ‘javascript:alert(1)’ or a URL pointing to an external malicious script. The attack vector is via the ‘display-map’ shortcode with the ‘demo’ attribute set to true. An attacker would use a URL such as: https://example.com/?map=javascript:alert(document.cookie). When a user clicks this link and the page renders the vulnerable shortcode, the malicious JavaScript executes in the context of the user’s session. No authentication is required, only user interaction (clicking a crafted link).
The patch in version 1.6.28 introduces a critical check. After sanitizing the ‘map’ parameter, it adds a filter_var($map_param, FILTER_VALIDATE_URL) validation. If the parameter is a valid URL (as determined by PHP’s filter_var function), the assignment to $main_meta[‘map’] is skipped entirely. This means any attempt to inject a URL-based payload (including javascript: URIs, which FILTER_VALIDATE_URL considers valid) will be ignored by the plugin. The patch effectively breaks the exploitation path by preventing any URL-like input from influencing the map rendering.
If exploited, an attacker can execute arbitrary JavaScript in the context of the victim’s browser. This allows the attacker to perform actions such as stealing session cookies, redirecting users to phishing sites, performing actions on behalf of the user, or defacing the page. Since the vulnerability is reflected (non-persistent), the attacker must trick the user into clicking a malicious link, limiting the scale of attack. However, the lack of authentication requirements makes it a viable vector for targeted phishing campaigns.
