Stored Cross-Site Scripting Vulnerability in WP Go Maps Plugin
CVE-2024-1582

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
WP Go Maps
Vendor
CVE Published:
13 March 2024

Summary

The WP Go Maps plugin for WordPress is susceptible to a stored cross-site scripting vulnerability that arises from inadequate input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level permissions or higher can exploit the 'wpgmza' shortcode to inject arbitrary web scripts into pages. This injected code executes whenever any user accesses the affected page, posing serious security risks. Users are encouraged to update to the latest version to mitigate this vulnerability.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3045434/wp-g...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.