EUVD-2026-24702
GHSA-ppmh-rcj7-3qgj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Posts map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' shortcode attribute in all versions up to, and including, 0.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in Posts Map plugin for WordPress up to version 0.1.3 allows authenticated contributors to inject arbitrary JavaScript via the 'name' shortcode attribute. When any user accesses a page containing the malicious shortcode, the injected script executes in their browser with the privileges of their WordPress session, potentially enabling account compromise, admin impersonation, or malware distribution. The vulnerability requires contributor-level or higher access and affects all versions through 0.1.3.
Technical ContextAI
Posts Map is a WordPress plugin that renders interactive maps with custom post data using shortcode attributes. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) - specifically, the 'name' attribute of the Posts Map shortcode is passed directly to HTML output without proper sanitization during input processing or escaping during output rendering. WordPress shortcode handlers typically receive user-supplied parameters, which must be sanitized (cleaned of dangerous input) via functions like sanitize_text_field() and escaped for output context via esc_attr() for HTML attributes or esc_html() for text content. The plugin's code at lines 33 and 78 of posts-map.php shows the vulnerable shortcode handling and rendering logic. The CPE cpe:2.3:a:lucdecri:posts_map:*:*:*:*:*:*:*:* indicates this affects all versions of the plugin authored by lucdecri.
RemediationAI
Update Posts Map plugin to version 0.1.4 or later immediately - this patched version will be released following responsible disclosure (check the WordPress plugin repository for the latest available version). Until a patch is released or available, implement the following compensating controls: (1) Restrict contributor-level access to post/page creation to only fully-trusted users - disable contributor publishing privileges if possible and require editor+ review before content goes live (this limits attack surface but may impact workflow); (2) use WordPress security plugins like Wordfence, Sucuri, or iThemes Security to enable Content Security Policy (CSP) headers, which block inline script execution even if XSS is injected (requires CSP header configuration and may break some legitimate plugins); (3) disable or deactivate Posts Map plugin entirely until a patch is confirmed available (most effective mitigation but removes plugin functionality); (4) audit recent pages/posts for malicious shortcodes using the plugin repository browser link https://plugins.trac.wordpress.org/browser/posts-map/tags/0.1.3/posts-map.php to understand the vulnerable code pattern. Wordfence provides additional mitigation guidance at https://www.wordfence.com/threat-intel/vulnerabilities/id/e02c5817-7a54-4958-a076-71e5e7729cda?source=cve.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today