Stored Cross-Site Scripting in Mapster WP Maps Plugin for WordPress

CVE-2026-107743

What is CVE-2026-107743?

The Mapster WP Maps plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability in versions up to and including 2.0.5. This vulnerability arises from the improperly configured REST route at /wp-json/mapster-wp-maps/save-mapmaker, which is accessible without sufficient permission checks. The plugin's sanitization processes fail to adequately sanitize all inputs, specifically allowing harmful scripts to be injected through improperly handled loading_background_color values. Consequently, unauthenticated attackers can exploit this flaw to inject malicious scripts into pages viewed by users, potentially compromising their sessions and data.

References