EUVD-2025-209491
GHSA-9726-56v6-8wh4
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
The WP Maps - Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'put_wpgm' shortcode in all versions up to, and including, 4.8.7. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored XSS in WP Maps plugin for WordPress allows authenticated contributors to inject malicious scripts via the 'put_wpgm' shortcode due to insufficient input sanitization and output escaping. Attackers with contributor-level access and above can craft malicious shortcode attributes that persist in page content and execute for all subsequent visitors. All versions up to 4.8.7 are affected; patched version 4.8.8 is available.
Technical ContextAI
The vulnerability resides in the WP Maps - Store Locator plugin's handling of the 'put_wpgm' shortcode, a WordPress feature that allows administrators and contributors to embed dynamic content via square-bracket syntax. The plugin fails to properly sanitize user-supplied shortcode attributes before storing them in the database and fails to escape the output when rendering the shortcode on the front-end. This violates WordPress security best practices for both sanitization (cleaning input at entry) and escaping (cleaning output at display). CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause; the plugin does not filter or validate attribute values that could contain HTML/JavaScript payloads. The attack vector is network-based because WordPress shortcodes are processed server-side but the injection occurs through the web interface, and authentication is required (PR:L, contributor level minimum). The scope is changed (S:C) because stored XSS affects all site visitors, not just the attacker.
RemediationAI
Immediately upgrade the WP Maps plugin to version 4.8.8 or later, which patches the input sanitization and output escaping flaws in the 'put_wpgm' shortcode handler. Update via WordPress Admin Dashboard (Plugins > Installed Plugins > WP Maps > Update) or download from https://plugins.trac.wordpress.org/changeset?old_path=wp-google-map-plugin/tags/4.8.7/wp-google-map-plugin.php&new_path=wp-google-map-plugin/tags/4.8.8/wp-google-map-plugin.php. While waiting for the update, audit all published pages and posts containing the 'put_wpgm' shortcode to ensure no malicious attributes are present; use WordPress Search & Replace plugins if needed to quickly identify affected content. Restrict contributor-level access to only trusted users and consider temporarily revoking the ability to edit pages/posts containing this shortcode until the patch is deployed. Monitor site traffic and log files for evidence of XSS payload injection or execution (search for unusual script tags or event handlers in page content). These workarounds have limited effectiveness and are not substitutes for patching; the primary mitigation is upgrading to 4.8.8 immediately.
Share
External POC / Exploit Code
Leaving vuln.today