CBX Map for Google Map & OpenStreetMap < 1.1.12 - Contributor+ Stored XSS via shortcode

2023-11-2300:00:00

wpscan.com

plugin validation escape shortcode contributor role stored xss

0.0004 Low

EPSS

Percentile

14.2%

JSON

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

CPENameOperatorVersion
eq1.1.12

CPE	Name	Operator	Version
		eq	1.1.12

References

patchstack.com/database/vulnerability/cbxgooglemap/wordpress-cbx-map-for-google-map-openstreetmap-plugin-1-1-11-cross-site-scripting-xss-vulnerability

0.0004 Low

EPSS

Percentile

14.2%

JSON

Related for WPVDB-ID:AA6B9EE6-E4C6-40B5-912F-A84BA34F890C