CVE-2026-107743: Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permissioncallback that unconditionally returns true (no capability check, no nonce), together with the mapsterwriteconfigtoacf() helper only sanitizing string config values with sanitizetextfield() — which strips HTML tags but leaves quote characters intact — and the mapsterwpmap shortcode renderer in mapsterwordpressmapsshortcodedisplay() concatenating the stored loadingbackgroundcolor value into a single-quoted inline style attribute without escattr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
No authentication, WordPress capability, or nonce is required. An unauthenticated remote attacker can submit a malicious value through the save-mapmaker REST route.
What must be present for the injected script to run?
The attacker must inject a map configuration affecting config.loading.background, and a user must access a page that renders the injected map through the mapster_wp_map shortcode. The payload executes in the visiting user's browser when that page is viewed.
Are standard access controls sufficient to prevent exploitation?
No. The affected REST route's permission callback unconditionally allows requests, so normal WordPress capability checks and nonce validation are not enforced for this operation.
How can administrators check for potential compromise?
Review stored map configuration data for unexpected or suspicious values in the loading background color setting, particularly values containing quote characters or script-like attribute content. Also identify pages using the mapster_wp_map shortcode, as those are the pages where a stored payload would execute.