CVE-2023-6627: WP Go Maps < 9.0.28 - Unauthenticated Stored XSS
Published Jan 8, 2024
·Updated
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attackers can abuse to store malicious HTML/Javascript on the site.
Affected Software
1 affected component
Codecabin Wp Go Maps Wordpress<9.0.28
Event History
Jan 8, 2024
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-6627?
CVE-2023-6627 is considered a high severity vulnerability due to its potential for stored cross-site scripting attacks.
2
How do I fix CVE-2023-6627?
To fix CVE-2023-6627, update the WP Go Maps plugin to version 9.0.28 or later.
3
What type of vulnerability is CVE-2023-6627?
CVE-2023-6627 is a stored cross-site scripting (XSS) vulnerability.
4
What can attackers do with CVE-2023-6627?
Attackers can exploit CVE-2023-6627 to store malicious HTML or JavaScript on the compromised site.
5
Which versions of WP Go Maps are affected by CVE-2023-6627?
CVE-2023-6627 affects all versions of WP Go Maps prior to 9.0.28.