MapPress Maps for WordPress < 2.88.15 – Contributor+ Stored XSS | CVE 2024-0420 | Plugin Vulnerabilities

Description

The plugin does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks

Proof of Concept

As a contributor, create/edit a map with the below payload as title and attach it to a post (can be done in the post dashboard in the Map column)

<script>alert(/XSS/)</script>

The XSS will be triggered when anyone access the post dashboard (/wp-admin/edit.php?post_type=post)

Affects Plugins

mappress-google-maps-for-wordpress

Fixed in 2.88.15

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Salvatore Bova

Submitter

Salvatore Bova

Verified

Yes

WPVDB ID

b6187ef8-70f4-4911-abd7-42bf6b7e54b7

Timeline

Publicly Published

2024-01-17 (about 1 year ago)

Added

2024-01-17 (about 1 year ago)

Last Updated

2024-01-17 (about 1 year ago)

Other

Published

Title

Published

2023-11-15

Title

BP Profile Shortcodes Extra < 2.5.3 - Contributor+ Stored XSS

Published

2025-03-10

Title

ProductDyno < 1.0.25 - Reflected Cross-Site Scripting via 'res' Parameter

Published

2021-05-24

Title

Coming Soon by Supsystic < 1.7.6 - Reflected Cross-Site Scripting

Published

2025-01-07

Title

wp custom countdown <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-11-15

Title

Gallery Manager <= 1.6.58 - Reflected Cross-Site Scripting