Stored Cross-Site Scripting in Posts Map Plugin for WordPress

CVE-2026-6236

What is CVE-2026-6236?

The Posts Map plugin for WordPress is susceptible to a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping in the 'name' shortcode attribute. This vulnerability affects all versions up to and including 0.1.3, enabling authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. Whenever a user accesses these compromised pages, the injected scripts will execute, potentially leading to security breaches such as data theft or unauthorized actions.

References