Stored Cross-Site Scripting Vulnerability in Google Maps Plugin for WordPress
CVE-2024-10621
6.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 8 November 2024
What is CVE-2024-10621?
The Simple Shortcode for Google Maps plugin for WordPress contains a vulnerability that permits Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping on user-supplied attributes in the pw_map shortcode. This flaw affects all plugin versions up to and including 1.5.4, enabling authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts are executed whenever a user visits an affected page, potentially compromising user data and site integrity.
Affected Version(s)
Simple Shortcode for Google Maps * <= 1.5.4