Mapster WP Maps CVE-2026-39720

Exploitation requires the Mapster WP Maps plugin (version 2.0.4 or earlier) to be installed and active on a WordPress site, and a victim must interact with attacker-influenced content (UI:R) - loading a crafted URL or viewing a page where the unsanitized map input is rendered. No authentication is needed to inject the payload (PR:N), making any publicly reachable endpoint that reflects/stores the vulnerable map parameter exploitable. Limiting factors: the mandatory user-interaction step prevents fully automated server-side compromise, impact is confined to the victim's browser session (session/token theft, forged actions, UI manipulation) rather than direct host takeover, and highest value is realized only when a high-privilege user (administrator) is the one who triggers the payload. Exact injectable parameter/feature is not specified in the provided data.

This is a moderate-severity reflected/stored-style Cross-Site Scripting flaw (CWE-79) in the Mapster WP Maps WordPress plugin at versions <= 2.0.4, reported by Patchstack with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The CVSS vector indicates a network-reachable, low-complexity, unauthenticated attack (PR:N) that nonetheless requires user interaction (UI:R) - a victim must load or click attacker-influenced content - and the scope-changed flag (S:C) reflects script execution in the victim's browser context outside the vulnerable component. No EPSS score, CISA KEV listing, SSVC decision data, or public proof-of-concept was supplied in the intelligence set, so exploitation probability cannot be quantified from this input: there is no public exploit identified at time of analysis and no confirmed active exploitation. Realistically this is a typical mass-scanned WordPress plugin XSS - individually a mid-tier priority rather than an emergency, because the UI:R requirement and limited C/I/A (all Low) cap the impact at session/token theft, UI defacement, or admin-targeted script execution rather than direct server compromise. Priority rises sharply if the specific site exposes the vulnerable map input to high-privilege users (e.g., persistent payload rendered in wp-admin). Absent EPSS/KEV signals, treat as a standard patch-on-cycle item unless the plugin is public-facing and widely used on the asset.

An unauthenticated attacker crafts a malicious URL or submits attacker-controlled input to a Mapster WP Maps map parameter that is reflected or stored without proper sanitization, embedding JavaScript. When a victim (a site visitor or, more damagingly, a logged-in administrator) loads the affected page, the script executes in their browser session, enabling cookie/session-token theft, admin-action forgery, or page defacement. No public proof-of-concept was provided in the input, so exploitation feasibility is inferred from the CVSS vector rather than demonstrated code.