What is the CVSS score of CVE-2026-9594?

CVE-2026-9594 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WP Maps CVE-2026-9594

EUVD-2026-34959 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-06 Wordfence

GHSA-93wv-28fj-w4gg

XSS Google WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:21 vuln.today

CVE Published

Jun 06, 2026 - 03:28 nvd

MEDIUM 4.4

DescriptionCVE.org

The WP Maps - Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'location_messages' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to hold the custom wpgmp_manage_location capability, which is granted to administrators by default but can be assigned to lower-privileged roles via the plugin's Permissions screen.

AnalysisAI

Stored Cross-Site Scripting in WP Maps (all versions through 4.9.4) allows authenticated attackers holding the wpgmp_manage_location capability - granted to administrators by default but delegable to lower-privileged roles - to inject persistent malicious scripts via the 'location_messages' parameter. The CVSS scope change (S:C) confirms the injected payload executes across victim browser sessions on any page rendering the affected shortcode, enabling session hijacking or unauthorized actions on behalf of site visitors. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV; however, the delegable capability expands the potential attacker pool beyond pure administrators.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this root cause: the plugin fails to sanitize user-supplied input stored in the 'location_messages' parameter and fails to escape it on output. The vulnerable code paths are identified in the plugin's source at put-wpgmp.php (line 632) and model.location.php (line 299) - the former handles shortcode rendering and the latter handles location model persistence, meaning the unsanitized value is both stored and rendered without escaping. The affected product per CPE is cpe:2.3:a:flippercode:wp_maps_-_google_maps,openstreetmap,mapbox,store_locator,listing,directory_&_filters:*:*:*:*:*:*:*:* - a multi-feature mapping plugin supporting Google Maps, OpenStreetMap, and Mapbox integrations for WordPress. The scope change in the CVSS vector (S:C) reflects the standard XSS dynamic where the vulnerability is exercised in the server context but the impact lands in the victim's browser context.

RemediationAI

Upstream fix available (commit/changeset 3550683 referenced at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3550683%40wp-google-map-plugin&new=3550683%40wp-google-map-plugin); a released patched version beyond 4.9.4 is not independently confirmed from the provided data - verify via the WordPress plugin repository or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d082c6e6-a18a-44e2-9478-7189f9777198 before upgrading. As a compensating control pending patch confirmation, restrict the wpgmp_manage_location capability exclusively to fully trusted administrator accounts via the plugin's Permissions screen - this eliminates the delegated lower-privilege attack path entirely, though it does not protect against a compromised administrator account. Additionally, deploying a Web Application Firewall rule targeting stored XSS patterns in the 'location_messages' parameter (Wordfence Premium includes relevant rules) can block exploitation attempts as a defense-in-depth measure. Note that restricting the capability may limit operational workflows if non-admin users currently manage map locations.