WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)

2021-06-0700:00:00

Mohammed Adam

348

wordpress

google maps

xss

authentication

stored

security vulnerability

EPSS

0.001

Percentile

47.6%

JSON

The plugin did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue Note: The vendor attributed the issue in the changelog to the wrong reporter (us, WPScan, as we reported it on behalf of the reporter). This will be corrected in the next version

Steps to Reproduce:

1) Edit a map (e.g /wp-admin/admin.php?page=wp-google-maps-menu&action=edit&map_id=1)
2) Change Map Name to <script>alert(document.cookie)</script>
3) Save the Map
4) Stored XSS will be triggered when viewing the Map List (/wp-admin/admin.php?page=wp-google-maps-menu)

POC Screenshots attached in dropbox link: https://www.dropbox.com/s/z4gc6386xcm83vm/Stored%20xss%20in%20WP%20Googlemaps.zip?dl=0

EPSS

0.001

Percentile

47.6%

JSON

Related for WPEX-ID:1270588C-53FE-447E-B83C-1B877DC7A954