WordPress Plugin Vulnerabilities

Travelers' Map < 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description

The Travelers' Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
travelers-map
Fixed in 2.3.3

References

CVE
CVE-2025-66098
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/066de6fc-a304-4faa-8706-3358fc2dbf0f

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Muhammad Yudha - DJ
Verified
No
WPVDB ID
02263ec4-66f6-4847-aac6-c42ec924c5ea

Timeline

Publicly Published
2025-11-09 (about 10 months ago)
Added
2025-11-24 (about 9 months ago)
Last Updated
2025-11-24 (about 9 months ago)

Other

Published
Title
Published
2024-03-07
Title
Premium Addons PRO < 2.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multi Scroll Widget
Published
2025-08-20
Title
Risk Free Cash On Delivery (COD) - WooCommerce <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-06-27
Title
Popup addon for Ninja Forms < 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-02-10
Title
WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce < 7.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-06-22
Title
Shortcodes Ultimate Pro < 7.1.5 - Contributor+ Stored Cross-Site Scripting XSS