Read the docs
TI-2025-43913 Aliases CVE-2025-9373GHSA-x77m-jvpm-6cv8

Stored cross-site scripting in PeproDev Branches Map plugin

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The PeproDev Branches Map (Mapify) plugin for WordPress is affected in all versions through 3.0.1. Insufficient input sanitization and output escaping enable stored cross-site scripting (CWE-79). An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts into pages that execute whenever a user opens an injected page.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
peprodevPeproDev Branches Map (Mapify)up to 3.0.1—No fix listedCNA
  • PeproDev Branches Map (Mapify) Vendorpeprodev Affected up to 3.0.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for PeproDev Branches Map (Mapify).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-14 Threatist record created from CVE-2025-9373
  2. 2026-10-14 Alias added: GHSA-x77m-jvpm-6cv8
  3. 2026-10-14 Priority changed: MEDIUM → LOW
  4. 2026-10-16 CISA SSVC decision points changed

References

Other 4

  • TI-2025-03394 PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover CVSS 3.1CRITICAL 9.8
  • TI-2025-03467 Improper authorization in PeproDev Ultimate Profile Solutions CVSS 3.1HIGH 8.2
  • TI-2024-17033 WordPress PeproDev Ultimate Invoice plugin <= 1.9.7 - Sensitive Data Exposure vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-12758 PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure CVSS 3.1MEDIUM 5.3
  • TI-2023-22256 WordPress PeproDev CF7 Database Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
  • TI-2025-03470 PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences