Stored Cross-Site Scripting Vulnerability in Easy Google Maps Plugin for WordPress
CVE-2024-5219

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Easy Google Maps
Vendor
CVE Published:
2 July 2024

Summary

The Easy Google Maps plugin for WordPress is affected by a vulnerability that allows authenticated attackers with Author-level access and above to exploit the plugin's file upload feature. Due to inadequate input sanitization and output escaping techniques, attackers can inject malicious web scripts into pages. These scripts execute whenever a user accesses the compromised page, potentially compromising user data and the integrity of the website.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/google-maps-ea...
https://plugins.trac.wordpress.org/changeset/3105921/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.