CVE-2025-9206

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9206", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-19T18:21:12.181Z", "datePublished": "2025-10-03T11:17:15.099Z", "dateUpdated": "2026-04-08T17:05:05.929Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:05.929Z"}, "affected": [{"vendor": "mekshq", "product": "Meks Easy Maps", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the map containing the malicious post."}], "title": "Meks Easy Maps <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8746b363-f1c2-42cb-83cf-639ab4102a50?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/meks-easy-maps/trunk/public/js/main-osm.js#L144"}, {"url": "https://plugins.trac.wordpress.org/browser/meks-easy-maps/trunk/inc/helpers.php#L419"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-10-31T13:48:38.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-02T22:34:49.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T14:48:43.325879Z", "id": "CVE-2025-9206", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T14:48:50.677Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9206", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T14:48:43.325879Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T14:48:48.067Z"}}], "cna": {"title": "Meks Easy Maps <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "mekshq", "product": "Meks Easy Maps", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.1.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T22:34:49.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8746b363-f1c2-42cb-83cf-639ab4102a50?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/meks-easy-maps/trunk/public/js/main-osm.js#L144"}, {"url": "https://plugins.trac.wordpress.org/browser/meks-easy-maps/trunk/inc/helpers.php#L419"}], "descriptions": [{"lang": "en", "value": "The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the map containing the malicious post."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-03T11:17:15.099Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9206", "state": "PUBLISHED", "dateUpdated": "2025-10-03T14:48:50.677Z", "dateReserved": "2025-08-19T18:21:12.181Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:15.099Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Meks Easy Maps", "vendor": "mekshq", "versions": [{"lessThanOrEqual": "2.1.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the map containing the malicious post."}, {"lang": "es", "value": "El plugin Meks Easy Maps para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del campo de t\u00edtulo de la publicaci\u00f3n en todas las versiones hasta, e incluyendo, la 2.1.4. Esto se debe a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda al mapa que contiene la publicaci\u00f3n maliciosa."}], "id": "CVE-2025-9206", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9206", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T14:48:43.325879Z", "version": "2.0.3"}}]}, "published": "2025-10-03T12:15:47.070", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/meks-easy-maps/trunk/inc/helpers.php#L419"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/meks-easy-maps/trunk/public/js/main-osm.js#L144"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8746b363-f1c2-42cb-83cf-639ab4102a50?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:35:42.670479+00:00", "value": {"mitigation_remediation": ["Update Meks Easy Maps to a version newer than 2.1.4 that includes the necessary input sanitization and output escaping.", "If the plugin is not required, consider deactivating and removing it from the site to eliminate the attack surface entirely.", "Restrict contributor or higher user permissions to read\u2011only or revoke unnecessary contributor accounts to reduce the chance that an authenticated user can inject malicious content."], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have the Meks Easy Maps plugin installed at version 2.1.4 or earlier are affected. The vulnerability exists regardless of the WordPress core version, as long as the plugin is present and a contributor or higher user can modify a map post.", "description_and_impact": "The Meks Easy Maps plugin for WordPress is vulnerable to stored cross\u2011site scripting because the title field of a map post is not properly sanitized or escaped before being rendered. An authenticated attacker with contributor or higher privileges can save a malicious script in the post title, causing the script to execute in the browser of any user who views the map. This allows the attacker to steal session cookies, deface pages, or launch secondary phishing attacks, all without requiring server\u2010side code execution.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests that, as of now, exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog, and there are no publicly reported exploits. Attackers must first authenticate to the WordPress admin area and possess at least contributor privileges, after which they can inject the malicious payload into the title field. Once the payload is stored, any user who opens the map will trigger its execution. The risk escalates if the site has numerous contributor accounts or if the site is publicly accessible to attackers who can obtain credentials, but without those prerequisites the exposure is limited."}}}}, "created": "2025-10-06T14:42:59.676059+00:00", "updated": "2026-04-21T02:45:25.943484+00:00", "vendors": ["mekshq", "mekshq$PRODUCT$meks_easy_maps", "wordpress", "wordpress$PRODUCT$wordpress"]}