CVE-2023-4839: fallo de gravedad media en wpgmaps WP Go Maps (formerly WP Google Maps)
WP Go Maps <= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site Scripting
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.4epss 0.3%
The WP Go Maps for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Productos afectados
wpgmaps · WP Go Maps (formerly WP Google Maps)CVEs relacionadas — wpgmaps WP Go Maps (formerly WP Google Maps)
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-6697MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2023-6777MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of ServiceEPSS 0.8%CVE-2024-5994MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-3557MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-1582MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-0593MEDIUMWP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting ModificationEPSS 0.3%