WordPress Plugin Vulnerabilities

SimpleMap Store Locator <= 2.6.1 - Unauthenticated Stored Cross-Site Scripting

Description

The SimpleMap Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
simplemap
No known fix

References

CVE
CVE-2024-22282
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7a600f11-03c3-4777-b1fe-212b085bacba

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Dimas Maulana
Verified
No
WPVDB ID
d47249d4-de2c-40cc-86c3-e0000db476d6

Timeline

Publicly Published
2024-01-16 (about 2 years ago)
Added
2024-01-22 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other

Published
Title
Published
2022-06-13
Title
WP Contact Slider < 2.4.7 - Editor+ Stored Cross-Site Scripting
Published
2024-10-24
Title
Scrollbar by webxapp – Best vertical/horizontal scrollbars plugin <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-04-28
Title
Ninja Forms < 3.10.1 - Admin+ Stored XSS
Published
2021-09-08
Title
User Activation Email <= 1.3.0 - Reflected Cross-Site Scripting
Published
2024-10-15
Title
Table of Contents Plus < 2411.1 - Admin+ Stored XSS