What is the CVSS score of CVE-2026-57670?

CVE-2026-57670 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Google Maps CP are affected by CVE-2026-57670?

Google Maps CP WordPress plugin (CodePeople, versions ≤1.2.5) contains a stored/reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into…

How to fix or mitigate CVE-2026-57670?

Within 24 hours: Disable or remove Google Maps CP plugin immediately if not essential; if retention is required, implement WAF rules blocking script payloads to plugin endpoints and restrict plugin access by IP. Within 7 days: Audit WordPress audit logs and security event logs for POST requests to plugin parameters containing script tags or encoded payloads; review user session activity for suspicious login sources or permission changes. Within 30 days: Monitor vendor (CodePeople) advisory channels for patch release; upon availability, test in staging and deploy immediately.

Google Maps CP CVE-2026-57670

EUVD-2026-41281 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-6x98-crj7-pq94

WordPress XSS Google Wordpress Plugin Google Maps Cp Codepeople

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network XSS (AV:N/PR:N) requiring victim click (UI:R); reflected script crosses into the WordPress session (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:18 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.

AnalysisAI

Stored/reflected Cross-Site Scripting in the Google Maps CP WordPress plugin (versions 1.2.5 and earlier, vendor CodePeople) lets an unauthenticated attacker inject malicious script that executes in a victim's browser after they interact with a crafted link or page. The flaw carries a CVSS 3.1 base score of 7.1 with a scope change, reflecting impact beyond the vulnerable component into the wider WordPress session. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Google Maps CP (plugin slug codepeople-post-map) is a WordPress plugin from CodePeople that embeds interactive Google Maps into posts and pages. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected or stored into HTML output without proper output encoding or input sanitization. Because it runs within WordPress, injected JavaScript executes in the context of the site's origin, giving access to the DOM, cookies, and any authenticated session active in the victim's browser. The CPE cpe:2.3:a:codepeople:google_maps_cp:*:*:*:*:*:*:*:* confirms all versions up to and including 1.2.5 are in scope.

RemediationAI

No vendor-released patch version is identified in the available data; a fixed release, if one exists, would be a version later than 1.2.5, but this is not independently confirmed. Administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/codepeople-post-map/vulnerability/wordpress-google-maps-cp-plugin-1-2-5-cross-site-scripting-xss-vulnerability) and the WordPress plugin repository for an update and apply it immediately once released. As compensating controls until then, deploy a Web Application Firewall (such as Patchstack's or Wordfence) with XSS rules to filter script payloads on the plugin's parameters, restrict or disable the Google Maps CP plugin on high-value or admin-facing sites if the mapping feature is non-essential (side effect: maps stop rendering), and enforce a strict Content-Security-Policy that disallows inline scripts to blunt payload execution (side effect: may break other plugins relying on inline JS).