Stored Cross-Site Scripting in Very Simple Google Maps Plugin for WordPress

CVE-2023-5744

Summary

The Very Simple Google Maps plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'vsgmap' shortcode. This security flaw arises from inadequate input sanitization and output escaping on user-supplied attributes. Authenticated users with contributor-level permissions can exploit this vulnerability, allowing them to inject arbitrary web scripts into pages. These malicious scripts will be executed whenever a user accesses the compromised pages, posing a significant risk to the site's security and user data.

References