MapPress Maps for WordPress < 2.94.9 - Contributor+ Stored XSS
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 0.5%
exploitation probability
0.5%top 61% of all CVEs
observed exploitation
nono source reports it
The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · MapPress Maps for WordPress