CVE-2024-1582: WP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgmza' shortcode in all versions up to, and including, 9.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1582?
CVE-2024-1582 has a medium severity rating due to the potential for stored cross-site scripting.
How do I fix CVE-2024-1582?
To fix CVE-2024-1582, update the WP Go Maps plugin to version 9.0.33 or higher.
What versions of WP Go Maps are affected by CVE-2024-1582?
CVE-2024-1582 affects all versions of the WP Go Maps plugin up to and including 9.0.32.
What types of attacks can CVE-2024-1582 facilitate?
CVE-2024-1582 can facilitate stored cross-site scripting attacks that may allow attackers to inject malicious scripts.
Is user data at risk with CVE-2024-1582?
Yes, user data can be at risk with CVE-2024-1582 due to the potential for unauthorized script execution on user sessions.