WordPress Plugin Vulnerabilities

MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSS

Description

The plugin does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks

Proof of Concept

As a contributor, create/edit a map with the below payload as title and attach it to a post (can be done in the post dashboard in the Map column)

<script>alert(/XSS/)</script>

The XSS will be triggered when anyone access the post dashboard (/wp-admin/edit.php?post_type=post)

Affects Plugins

Plugin icon
mappress-google-maps-for-wordpress
Fixed in 2.88.15

References

CVE
CVE-2024-0420

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Original Researcher
Salvatore Bova
Submitter
Salvatore Bova
Verified
Yes
WPVDB ID
b6187ef8-70f4-4911-abd7-42bf6b7e54b7

Timeline

Publicly Published
2024-01-17 (about 3 months ago)
Added
2024-01-17 (about 3 months ago)
Last Updated
2024-01-17 (about 3 months ago)

Other

Published
Title
Published
2023-02-02
Title
WP Booking System < 2.0.18.1 - Admin+ Stored XSS
Published
2019-12-02
Title
Superlist <= 2.9.2 - Stored Cross-Site Scripting (XSS)
Published
2022-06-08
Title
Gallery Bank <= 4.0.50 - Author+ Stored XSS via Gallery Description
Published
2014-08-01
Title
Video Metabox 1.1 - Stored Cross-Site Scripting (XSS)
Published
2022-02-02
Title
WP Time Slots Booking Form < 1.1.63 - Admin+ Stored Cross-Site Scripting