CVE-2026-39720: WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Mapster WP Maps pluginto a version that resolves this vulnerability.Fixed in 2.0.5
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need an account or other prior privileges to attempt exploitation. Exploitation still requires user interaction, as indicated by the UI:R vector.
Which installations are affected?
Mapster WP Maps versions up to and including 2.0.4 are affected according to the available data. The provided information does not state whether any particular configuration is required.
What impact could successful exploitation have?
The CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. As an XSS issue, successful exploitation may allow attacker-controlled script execution in a victim's browser context.