CVE-2025-4589

The Bon Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt-map' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-4589

The Bon Toolkit WordPress plugin (versions up to 1.3.2) is vulnerable to Stored Cross-Site Scripting via the bt-map shortcode due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (contributor level or higher) and can inject scripts that execute wh...