MapPress Maps for WordPress < 2.93 – Admin+ Stored XSS via Map Settings | CVE 2024-8620 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Proof of Concept

1. Go to https://example.com/wp-admin/admin.php?page=mappress
2. Under "POI Data", add an item an make the label: "><img src=x onerror=alert('XSS');>
3. Save the settings and see the XSS when the page reloads.

Affects Plugins

mappress-google-maps-for-wordpress

Fixed in 2.93

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Submitter

Kientt

Verified

Yes

WPVDB ID

d8b0ddd8-0380-4185-aa00-8437e2b617ad

Timeline

Publicly Published

2024-08-01 (about 1 year ago)

Added

2024-09-24 (about 1 year ago)

Last Updated

2024-09-24 (about 1 year ago)

Other

Published

Title

Published

2024-10-21

Title

Anchor Episodes Index (Spotify for Podcasters) < 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor_episodes Shortcode

Published

2023-09-03

Title

Post Affiliate Pro < 1.26.10 - Admin+ Stored XSS

Published

2023-02-23

Title

CM Answers < 3.2.0 - Admin+ Stored XSS

Published

2025-01-16

Title

Internal Links Generator <= 3.51 - Reflected Cross-Site Scripting

Published

2025-05-30

Title

History Log by click5 <= 1.0.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting