What is the CVSS score of CVE-2026-4268?

CVE-2026-4268 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4268?

Organizations using all should be aware of moderate risk from CVE-2026-4268, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-4268?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-4268

EUVD-2026-12742 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-18 Wordfence

WordPress XSS Google

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 18, 2026 - 02:30 euvd

EUVD-2026-12742

Analysis Generated

Mar 18, 2026 - 02:30 vuln.today

CVE Published

Mar 18, 2026 - 01:24 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpgmza_custom_js’ parameter in all versions up to, and including, 10.0.05 due to insufficient input sanitization and output escaping and missing capability check in the 'admin_post_wpgmza_save_settings' hook anonymous function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

WP Go Maps (formerly WP Google Maps) plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'wpgmza_custom_js' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level privileges or higher can inject arbitrary JavaScript code that executes in the browsers of users visiting affected pages, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability affects all versions up to and including 10.0.05, with a CVSS score of 6.4 indicating moderate severity but significant practical impact due to low attack complexity and the ability to affect site-wide functionality.

Technical ContextAI

The vulnerability stems from a failure to properly sanitize and escape user input in the 'admin_post_wpgmza_save_settings' hook anonymous function handler within the WP Go Maps plugin (CPE: cpe:2.3:a:wpgmaps:wp_go_maps_(formerly_wp_google_maps):*:*:*:*:*:*:*:*). This is a classic Stored XSS vulnerability classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin accepts the 'wpgmza_custom_js' parameter—intended for legitimate custom JavaScript configuration—but fails to apply WordPress sanitization functions (such as sanitize_text_field() or wp_kses_post()) before storage in the database, and does not properly escape output when rendering the stored value. Additionally, the hook lacks an adequate capability check (missing current_user_can() verification), allowing Subscriber-level users to exploit what should be an administrative function. The vulnerability is compounded by the fact that custom JavaScript is stored persistently and executed whenever any user accesses pages containing the affected map elements.

RemediationAI

Immediately upgrade WP Go Maps to version 10.0.06 or later, which includes fixes for input sanitization and output escaping of the 'wpgmza_custom_js' parameter and adds proper capability checks to the settings save hook. Users should access the WordPress admin dashboard, navigate to Plugins, locate WP Go Maps, and click the update button; alternatively, updates can be managed via wp-cli with the command 'wp plugin update wp-google-maps'. As an interim mitigation before patching, restrict the Subscriber user role's ability to modify plugin settings by using role management plugins (e.g., User Role Editor) to remove access to the 'manage_options' capability from non-administrative users, and consider disabling user registration if not essential to business operations. Additionally, implement a Web Application Firewall (WAF) rule to detect and block JavaScript injection attempts in POST parameters containing 'wpgmza_custom_js'. Monitor the plugin's official advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d5599101-a7bd-4aa7-91da-f11694bdc000 and the WordPress plugin repository for patch confirmation before removing temporary mitigations.