WordPress Plugin Vulnerabilities

WP Go Maps < 9.0.33 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affects Plugins

Plugin icon
wp-google-maps
Fixed in 9.0.33

References

CVE
CVE-2023-4839
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/208c5ed1-879f-45ea-833e-d2e54c4f063f

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.4 (medium)

Miscellaneous

Original Researcher
Marco Wotschka, Akbar Kustirama
Verified
No
WPVDB ID
d05a709a-5cf6-4d05-873e-6207eb36b319

Timeline

Publicly Published
2024-03-12 (about 2 years ago)
Added
2024-03-13 (about 2 years ago)
Last Updated
2024-03-13 (about 2 years ago)

Other

Published
Title
Published
2024-06-22
Title
EventON < 2.2.15 - Admin+ Stored Cross-Site Scripting via event subtitle
Published
2025-04-01
Title
Leartes TRY Exchange Rates <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-01-09
Title
Email Encoder < 2.1.10 - Contributor+ Stored Cross-Site Scripting
Published
2016-02-23
Title
WP Advanced Importer Plugin < 2.2 - Reflected Cross-Site Scripting (XSS)
Published
2024-04-05
Title
Salon booking system < 9.6.6 - Editor+ Stored XSS