Stored XSS Vulnerability in WP Baidu Map Plugin

CVE-2024-9886

Summary

The WP Baidu Map plugin for WordPress exhibits a vulnerability that allows for Stored Cross-Site Scripting (XSS) due to inadequate input validation and output escaping of user-supplied attributes through the 'baidu_map' shortcode. This security flaw permits authenticated attackers with at least contributor-level access to infuse arbitrary web scripts into web pages. When users access these compromised pages, the injected scripts execute, posing significant risks to site integrity and user data. It is crucial for WordPress administrators and site owners to ensure their plugins are up-to-date and follow security best practices to mitigate such vulnerabilities.

References