Google Maps Anywhere <= 1.2.6.3 – Admin+ Stored Cross-Site Scripting | CVE 2022-2424

Description

The plugin does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

Put the following payload in any of the plugin settings: "><svg/onload=alert(/XSS/)>

Affects Plugins

google-maps-anywhere

No known fix

References

CVE

CVE-2022-2424

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

3.4 (low)

Miscellaneous

Original Researcher

Vinay Varma Mudunuri, Krishna Harsha Kondaveeti

Submitter

Vinay Varma Mudunuri

Verified

Yes

WPVDB ID

2f9d3256-85c0-44fa-b0be-faa8989a1909

Timeline

Publicly Published

2022-07-18 (about 3 years ago)

Added

2022-07-18 (about 3 years ago)

Last Updated

2023-04-17 (about 2 years ago)

Other

Published

Title

Published

2025-10-31

Title

Popup addon for Ninja Forms < 3.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2025-04-10

Title

Affiliate Links Lite <= 3.1.0 - Reflected Cross-Site Scripting

Published

2024-07-06

Title

WPFavicon <= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting

Published

2025-01-15

Title

Verge3D < 4.8.1 - Reflected Cross-Site Scripting

Published

2025-10-16

Title

e2pdf < 1.28.10 - Authenticated (Contributor+) Stored Cross-Site Scripting