CVE-2026-39720: WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need an account or other prior privileges to attempt exploitation. Exploitation still requires user interaction, as indicated by the UI:R vector.

Q: Which installations are affected?

Mapster WP Maps versions up to and including 2.0.4 are affected according to the available data. The provided information does not state whether any particular configuration is required.

Q: What impact could successful exploitation have?

The CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. As an XSS issue, successful exploitation may allow attacker-controlled script execution in a victim's browser context.

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

Affected Software

1 affected component

Mapster Mapster WP Maps<=2.0.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Mapster WP Maps plugin to a version that resolves this vulnerability.
Fixed in 2.0.5

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need an account or other prior privileges to attempt exploitation. Exploitation still requires user interaction, as indicated by the UI:R vector.

Which installations are affected?

Mapster WP Maps versions up to and including 2.0.4 are affected according to the available data. The provided information does not state whether any particular configuration is required.

What impact could successful exploitation have?

The CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. As an XSS issue, successful exploitation may allow attacker-controlled script execution in a victim's browser context.

CVE-2026-39720: WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What impact could successful exploitation have?