What is the CVSS score of CVE-2026-7464?

CVE-2026-7464 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

WP Google Maps Integration CVE-2026-7464

EUVD-2026-29415 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-9mhf-q7jh-pf77

WordPress XSS Google Wordpress Plugin Wp Google Maps Integration

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:48 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.1

DescriptionCVE.org

The WP Google Maps Integration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting (XSS) in WP Google Maps Integration plugin for WordPress versions up to 1.2 allows unauthenticated attackers to inject arbitrary web scripts via the page parameter due to insufficient input sanitization and output escaping. Exploitation requires tricking an administrator into clicking a malicious link, but successful attacks can hijack admin sessions, modify site content, or steal credentials with medium attack complexity and limited immediate confidentiality and integrity impact.

Technical ContextAI

The vulnerability exists in WordPress plugin code where user-supplied input from the page parameter is reflected in HTTP responses without proper sanitization or HTML entity encoding. The affected plugin (trapesium/wp_google_maps_integration) fails to apply WordPress security functions like sanitize_text_field() on input or esc_attr() or esc_html() on output in multiple admin table display files. This is a classic Reflected XSS vulnerability (CWE-79) where the attacker's payload traverses only the request-response cycle without persistence in the database, but executes in the victim's browser with the same privileges as the logged-in administrator.

RemediationAI

Update WP Google Maps Integration plugin to the latest patched version immediately - check the WordPress plugin repository or Wordfence advisory for the exact fixed version number. Until patching is available, apply input sanitization using WordPress functions (sanitize_text_field() on $_GET['page'] and similar parameters) and output escaping (esc_attr() or esc_html()) before rendering user input in admin pages. Restrict plugin access to trusted administrators only via user role capabilities. Disable the plugin temporarily if patches are not yet released. Review access logs for signs of prior exploitation (HTTP requests with script payloads in the page parameter to admin interface URLs). Note that disabling the plugin may impact site functionality if actively used for Google Maps embedding, requiring alternative mapping solutions.