CVE-2025-28858

High

Published: 26 March 2025

Published

26 March 2025

Modified

29 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0022 44.7th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-28858 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-28858 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-Site Scripting (XSS) as classified under CWE-79, in the Arrow Maps (ap-google-maps) WordPress plugin developed by Arrow Plugins. This flaw affects all versions of the plugin from n/a through 1.0.9. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting its high severity due to network accessibility, low attack complexity, lack of required privileges, user interaction dependency, and changed scope.

Remote attackers without privileges can exploit this vulnerability by crafting malicious inputs or links that are reflected unsanitized in the plugin's web page generation. Exploitation requires tricking a user, such as a site visitor or administrator, into interacting with the payload (e.g., clicking a link). Successful attacks execute arbitrary JavaScript in the victim's browser context, potentially compromising session data, with low impacts on confidentiality, integrity, and availability but amplified by the scope change to other users or resources.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/ap-google-maps/vulnerability/wordpress-arrow-maps-plugin-1-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS issue specifically in Arrow Maps plugin version 1.0.9, providing details for WordPress security practitioners on the vulnerability.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-8158

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Maps ap-google-maps allows Reflected XSS.This issue affects Arrow Maps: from n/a through <= 1.0.9.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

Why these techniques?

Reflected XSS in public-facing WordPress plugin enables exploitation of public-facing apps (T1190), arbitrary JavaScript execution (T1059.007), and user execution via malicious links (T1204.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0