CVE-2023-6697: falha de média gravidade em wpgmaps WP Go Maps (formerly WP Google Maps)
WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 6.1epss 1.0%
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the map id parameter in all versions up to, and including, 9.0.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
wpgmaps · WP Go Maps (formerly WP Google Maps)CVEs relacionadas — wpgmaps WP Go Maps (formerly WP Google Maps)
No mesmo produto, das mais perigosas para as menos.
CVE-2023-6777MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of ServiceEPSS 0.8%CVE-2024-5994MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-4839MEDIUMWP Go Maps <= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-3557MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-1582MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-0593MEDIUMWP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting ModificationEPSS 0.3%