CVE-2026-13179: WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fc-call-nonce nonce required by the endpoint is exposed to all frontend visitors who view a map page via window.wpgmplocal.nonce, enabling any authenticated subscriber to read the nonce and craft a valid request; additionally, the secondary wpnonce check in the drawing handler can be bypassed by simply omitting the wpnonce parameter from the request.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker also needs access to a frontend page that displays a map in order to obtain the required fc-call-nonce.
Are map pages exposed by default to unauthenticated visitors?
The nonce is exposed through window.wpgmp_local.nonce to all frontend visitors who view a map page. However, exploitation still requires an authenticated account with at least Subscriber privileges.
What is required for a successful exploit request?
An attacker can read the fc-call-nonce from a map page and submit a crafted shapes_values value. The drawing handler's secondary _wpnonce validation can be bypassed by omitting the _wpnonce parameter.
What is the impact after malicious content is stored?
Injected JavaScript executes whenever a user visits the page containing the attacker-controlled content. The vulnerability affects confidentiality and integrity, while no availability impact is indicated.