WordPress WP Go Maps Plugin <= 9.0.29 is vulnerable to Cross Site Scripting (XSS)

Software WP Go Maps Type Plugin Vulnerable versions = 9.0.29 Fixed in 9.0.30 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29931 Patch priority Medium CVSS severity Medium 7.1 Developer WP Go Maps PSID ec3cfcab7699 Credits Rafie Muhammad Patchstack Required...

Design/Logic Flaw

The WP Go Maps formerly WP Google Maps WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attackers can abuse to store malicious HTML/Javascript on the site...

CVE-2021-36871 WordPress WP Google Maps Pro premium plugin <= 8.1.11 - Multiple Authenticated Persistent XSS vulnerabilities

Multiple Authenticated Persistent Cross-Site Scripting XSS vulnerabilities in WordPress WP Google Maps Pro premium plugin versions &attributes, Name &attributes, &icons, &names, &description, &link, &title...

CVE-2021-36871

CVE-2021-36871 corresponds to multiple authenticated persistent cross-site scripting (XSS) vulnerabilities in the WordPress WP Google Maps Pro premium plugin (versions ≤ 8.1.11). The issues arise from unsanitized inputs in several vulnerable parameters (e.g., wpgmaps_marker_category_name, &attrib...

PT-2021-16024 · WordPress · Wp Google Maps

Name of the Vulnerable Software and Affected Versions: WP Google Map WordPress plugin versions prior to 1.7.7 Description: The issue is related to a Stored Cross-Site Scripting problem. It occurs because the Map Title is not properly sanitised or escaped before being outputted on the page. This c...

WordPress Plugin WP Google Maps 8.1.11 - Stored Cross-Site Scripting (XSS)

Exploit Title: WordPress Plugin WP Google Maps 8.1.11 - Stored Cross-Site Scripting XSS Date: 22/6/2021 Exploit Author: Mohammed Adam Vendor Homepage: https://www.wpgmaps.com/ Software Link: https://wordpress.org/plugins/wp-google-maps/ Version: 5.7.2 Tested on: Windows 10 CVE: CVE-2021-24383...

WordPress WP Google Maps plugin cross-site scripting vulnerability (CNVD-2021-49141)

WordPress is a set of open source blogging platforms developed using the PHP language by the WordPress Foundation. A stored cross-site scripting vulnerability exists in the WordPress WP Google Maps plugin. An attacker can exploit this vulnerability to execute client-side code by injecting...

CVE-2021-24383

The CVE-2021-24383 entry concerns the WordPress WP Google Maps plugin (versions prior to 8.1.12). The vulnerability is an authenticated Stored Cross-Site Scripting (XSS) flaw caused by insufficient sanitization/validation/escaping of the Map Name when output in the Map List on the admin dashboard...

WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue Note: The vendor attributed the issue in the changelog to the wrong reporter us, WPScan, as we reported it on behalf of th...

WordPress Plugin Rest Google Maps < 7.11.18 - SQL Injection

Exploit Title: WordPress Rest Google Maps Plugin SQL Injection Google Dork: inurl:index.php?restroute=3D/wpgmza/ Date: 2020-09-09 Exploit Author: Jonatas Fil Vendor Homepage: https://wordpress.org/plugins/wp-google-maps/developers Software Link: https://wordpress.org/plugins/wp-google-maps/...

CVE-2019-14792

The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectanglename or rectangleopacity parameter...

Design/Logic Flaw

The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectanglename or rectangleopacity parameter...

CVE-2019-14792

The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectanglename or rectangleopacity parameter...

CVE-2019-14792

The CVE-2019-14792 entry applies to the WordPress WP Google Maps plugin prior to version 7.11.35. The vulnerability arises from an XSS flaw in the plugin via the wp-admin/ rectangle_name or rectangle_opacity parameters, caused by insufficient input validation/sanitization. Public sources in the c...

WP Google Maps <= 7.11.34 - CSRF to Stored XSS

Lack of CSRF and authorisation checks, as well as sanitisation in the wpgmapshead function in legacy-core.php can lead to stored XSS issues...

WP Google Maps for WordPress < 7.11.17 Unauthenticated SQL Injection (CVE-2019-10692)

The WP Google Maps plugin for WordPress running on the remote web server is affected by an SQL injection SQLi vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulti...

Design/Logic Flaw

In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement...

CVE-2019-10692

Affected software: WordPress WP Google Maps plugin (versions before 7.11.18). Vulnerability details: The REST API implementation in includes/class.rest-api.php does not sanitize field names before a SELECT statement, enabling an SQL injection. Public descriptions and templates consistently state ...

WP Google Maps 7.11.00-7.11.17 - Unauthenticated SQL Injection

The includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement, leading to an unauthenticated SQL injection issue. curl -k --silent "http://example.com/index.php?restroute=3D/wpgmza/v1/markers/&filter=3D%7B%7D&=fields=3D+from+wpusers+--+-"...

WP Google Maps 7.11.00-7.11.17 - Unauthenticated SQL Injection

The includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement, leading to an unauthenticated SQL injection issue. PoC curl -k --silent "http://example.com/index.php?restroute=3D/wpgmza/v1/markers/=3D%7B%7D&=fields=3D+from+wpusers+--+-"...