MapPress Maps for WordPress < 2.88.15 – Contributor+ Stored XSS | CVE 2024-0420 | Plugin Vulnerabilities

Description

The plugin does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks

Proof of Concept

As a contributor, create/edit a map with the below payload as title and attach it to a post (can be done in the post dashboard in the Map column)

<script>alert(/XSS/)</script>

The XSS will be triggered when anyone access the post dashboard (/wp-admin/edit.php?post_type=post)

Affects Plugins

mappress-google-maps-for-wordpress

Fixed in 2.88.15

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Salvatore Bova

Submitter

Salvatore Bova

Verified

Yes

WPVDB ID

b6187ef8-70f4-4911-abd7-42bf6b7e54b7

Timeline

Publicly Published

2024-01-17 (about 1 year ago)

Added

2024-01-17 (about 1 year ago)

Last Updated

2024-01-17 (about 1 year ago)

Other

Published

Title

Published

2021-03-16

Title

SEO Redirection < 6.4 - Authenticated Reflected Cross-Site Scripting (XSS)

Published

2023-11-03

Title

Comments Ratings <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2025-01-20

Title

Empty Tags Remover < 1.1.0 - Reflected Cross-Site Scripting

Published

2024-12-07

Title

The GDPR Framework By Data443 < 2.2.0 - Admin+ Stored XSS

Published

2025-01-06

Title

App Embed < 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting