EUVD-2026-69928
GHSA-2wgm-647f-6j6j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Reflected XSS with scope change; A:N substituted for A:L as reflected XSS has no availability impact on the server or victim system.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions.
AnalysisAI
Reflected Cross-Site Scripting in the Interactive Geo Maps WordPress plugin (versions <= 1.6.30) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to click a crafted URL. The vulnerability carries a CVSS 7.1 with scope change, meaning the injected script executes in the context of the victim's authenticated WordPress session rather than the plugin's own origin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have the Interactive Geo Maps plugin installed and active at version 1.6.30 or earlier, and the vulnerable plugin page or endpoint must be publicly accessible (or at minimum reachable by the attacker). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a moderate-to-high web risk profile: network-reachable, no authentication or special setup required of the attacker, but dependent on a victim clicking a crafted link (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Interactive Geo Maps plugin to a version above 1.6.30 per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/interactive-geo-maps/vulnerability/wordpress-interactive-geo-maps-plugin-1-6-30-reflected-cross-site-scripting-xss-vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify those running Interactive Geo Maps version 1.6.30 or earlier, and deploy Web Application Firewall rules to block reflected XSS attempts targeting the plugin. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Interactive Geo Maps
View allThe Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parame
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today