WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue Note: The vendor attributed the issue in the changelog to the wrong reporter (us, WPScan, as we reported it on behalf of the reporter). This will be corrected in the next version

PoC

Steps to Reproduce: 1) Edit a map (e.g /wp-admin/admin.php?page=wp-google-maps-menu&action;=edit&map;_id=1) 2) Change Map Name to 3) Save the Map 4) Stored XSS will be triggered when viewing the Map List (/wp-admin/admin.php?page=wp-google-maps-menu) POC Screenshots attached in dropbox link: https://www.dropbox.com/s/z4gc6386xcm83vm/Stored xss in WP Googlemaps.zip?dl=0