CVE-2026-125824: WordPress WP Go Maps plugin <= 10.1.10 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.1.11
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges and user interaction. The attack can be performed over the network with low complexity.
What is the potential impact if exploitation succeeds?
This is a stored XSS issue. The CVSS vector indicates low impact to confidentiality, integrity, and availability, with scope changed.
Are versions after 10.1.10 affected?
The available data identifies WP Go Maps versions through 10.1.10 as affected. It does not state whether versions later than 10.1.10 are affected or provide a fixed version.