WP Google Maps < 8.1.12 – Authenticated Stored Cross-Site Scripting (XSS) | CVE 2021-24383

Description

The plugin did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue

Note: The vendor attributed the issue in the changelog to the wrong reporter (us, WPScan, as we reported it on behalf of the reporter). This will be corrected in the next version

Proof of Concept

Steps to Reproduce:

1) Edit a map (e.g /wp-admin/admin.php?page=wp-google-maps-menu&action=edit&map_id=1)
2) Change Map Name to <script>alert(document.cookie)</script>
3) Save the Map
4) Stored XSS will be triggered when viewing the Map List (/wp-admin/admin.php?page=wp-google-maps-menu)

POC Screenshots attached in dropbox link: https://www.dropbox.com/s/z4gc6386xcm83vm/Stored%20xss%20in%20WP%20Googlemaps.zip?dl=0