What is the CVSS score of CVE-2026-57767?

CVE-2026-57767 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WP Google Maps Pro are affected by CVE-2026-57767?

WP Google Maps Pro WordPress plugin (all versions through 10.1.02) contains a stored/reflected cross-site scripting vulnerability exploitable by unauthenticated attackers to inject malicious scripts…

How to fix or mitigate CVE-2026-57767?

Within 24 hours, identify all WordPress installations using WP Google Maps Pro and determine installed versions; disable the plugin immediately or restrict access to authenticated administrators only. Within 7 days, implement Web Application Firewall (WAF) rules blocking script injection patterns, enable security logging to detect exploitation attempts, and send incident notification to all site administrators. Within 30 days, evaluate map functionality alternatives, establish monitoring for vendor security advisories, and plan migration timeline pending patch availability.

WP Google Maps Pro CVE-2026-57767

EUVD-2026-48179 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-rvgm-3m3f-r2mx

WordPress XSS Google Wordpress Plugin Wp Google Maps Pro

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable unauthenticated XSS needing victim interaction (UI:R); script crosses into the victim's session (S:C) with limited C/I/A impact, matching reflected/stored XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:22 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.

AnalysisAI

Stored/reflected Cross-Site Scripting in the WP Google Maps Pro WordPress plugin (all versions up to and including 10.1.02) lets an unauthenticated attacker inject browser-executed script that runs in the context of any user who views the affected page. Rated CVSS 7.1 with a scope-changed vector, the flaw requires victim interaction (UI:R) but no authentication (PR:N), meaning a crafted link or poisoned map component is enough to fire the payload. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the WP Google Maps Pro plugin (CPE cpe:2.3:a:codecabin.io:wp_google_maps_pro), a commercial WordPress mapping plugin from CodeCabin.io used to embed interactive Google Maps into WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), i.e. user-controllable input reaching an HTML/JS response context without adequate output encoding or input sanitization. Because the CVSS vector marks a scope change (S:C), the executed script crosses the plugin's own security boundary into the broader WordPress/browser context of the viewing user, which is characteristic of XSS where the vulnerable component and the impacted component (the victim's authenticated session/browser) differ.

RemediationAI

No fixed version was included in the provided data, so treat patch status as: no vendor-released patched version independently confirmed at time of analysis - check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-google-maps-pro/vulnerability/wordpress-wp-google-maps-pro-plugin-10-1-02-cross-site-scripting-xss-vulnerability) and the CodeCabin.io account portal for a release above 10.1.02 and upgrade to it as the primary fix. Until a patched build is confirmed, apply compensating controls: deploy a WAF or Patchstack virtual patch with XSS rules covering the plugin's map/parameter endpoints (trade-off: rule tuning may block legitimate map input); add a restrictive Content-Security-Policy that disallows inline script execution to blunt injected payloads (trade-off: can break themes/plugins relying on inline JS, so test in report-only mode first); and if the plugin's affected feature is non-essential, disable the Pro plugin to fully remove exposure (trade-off: maps stop rendering). Given UI:R, also caution editors/admins about following untrusted links to map pages.