Medium · 6.5 CVE-2025-32172 EUVD-2025-9834GHSA-r9q7-9m92-j6j6

WordPress YaMaps for WordPress plugin <= 0.6.40 - Cross Site Scripting (XSS) vulnerability

Published Apr 4, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Yuri Baranov Product: YaMaps for WordPress Category: Web / CMS

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yuri Baranov YaMaps for WordPress yamaps allows Stored XSS.This issue affects YaMaps for WordPress: from n/a through <= 0.6.40.

Affected products

Vendor	Product	Affected	Fixed
Yuri Baranov	YaMaps for WordPress	≤ 0.6.40	—

References

https://patchstack.com/database/Wordpress/Plugin/yamaps/vulnerability/wordpress-yamaps-for-wordpress-plugin-0-6-31-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry