CVE-2024-0420

2024-02-1216:15:08

[email protected]

web.nvd.nist.gov

2210

mappress

wordpress

plugin

2.88.15

stored cross-site scripting

xss

nvd

5.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.8%

JSON

The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks

Affected configurations

Vulners

Node

mappresspromappress_maps_for_wordpressRange<2.88.15

VendorProductVersionCPE
mappresspromappress_maps_for_wordpress*cpe:2.3:a:mappresspro:mappress_maps_for_wordpress:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mappresspro	mappress_maps_for_wordpress	*	cpe:2.3:a:mappresspro:mappress_maps_for_wordpress::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "MapPress Maps for WordPress",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "2.88.15"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]