MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scripting
CVE-2022-0208

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Mappress Maps For WordPress
Vendor
CVE Published:
14 February 2022

What is CVE-2022-0208?

The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting

Affected Version(s)

MapPress Maps for WordPress 2.73.4

References

https://wpscan.com/vulnerability/59a2abd0-4aee-47aa-ad3a-...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof ZajÄ…c
.
CVE-2022-0208 : MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scripting