Stored Cross-Site Scripting Vulnerability in MapPress Maps for WordPress

CVE-2023-4840

Summary

The MapPress Maps for WordPress plugin is vulnerable to Stored Cross-Site Scripting due to inadequate sanitization and escaping of user inputs via the 'mappress' shortcode. Authenticated attackers with contributor-level or higher permissions can exploit this vulnerability to inject malicious web scripts into pages. These scripts can be executed when other users access the compromised pages, potentially leading to unauthorized actions or data exposure.

References