CVE-2022-2424: Google Maps Anywhere <= 1.2.6.3 - Admin+ Stored Cross-Site Scripting
The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2424?
CVE-2022-2424 has a high severity rating due to its potential to facilitate Stored Cross-Site Scripting attacks.
How do I fix CVE-2022-2424?
To fix CVE-2022-2424, upgrade the Google Maps Anywhere plugin to a version higher than 1.2.6.3.
Who is affected by CVE-2022-2424?
CVE-2022-2424 affects users of the Google Maps Anywhere WordPress plugin version 1.2.6.3 and below.
What kind of attack can exploit CVE-2022-2424?
CVE-2022-2424 can be exploited for Stored Cross-Site Scripting attacks by high privilege users.
What settings are not sanitized in CVE-2022-2424?
CVE-2022-2424 does not sanitize and escape any of its plugin settings, leading to potential security vulnerabilities.