MapPress EUVD-2026-39687

Exploitation requires no authentication (PR:N) but does require victim interaction (UI:R) - the target must open an attacker-crafted link or visit a page where the malicious MapPress input is reflected/rendered, so this cannot be triggered fully autonomously against a passive server. The affected feature is the MapPress Maps plugin running at version 2.97.3 or earlier on a WordPress site; sites not running this plugin, or running a later patched build, are not exposed. The highest-value outcome depends on the victim being a privileged/logged-in user, since the changed scope (S:C) lets injected script act in the site's trusted context; impact against an unauthenticated visitor is limited to that visitor's own session.

Signals are mixed-to-moderate. The CVSS 3.1 base score is 7.1 (High), driven by network attack vector (AV:N), low complexity (AC:L), no privileges (PR:N), and a changed scope (S:C) with low impact to confidentiality, integrity and availability (C:L/I:L/A:L). The mitigating factor is the required user interaction (UI:R) - the victim must click a crafted link or visit an attacker-influenced page - which lowers automatability and makes exploitation opportunistic rather than wormable. No EPSS score was provided in the input, so exploitation probability cannot be quantified here; no KEV listing and no POC reference were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. SSVC inputs (exploitation status, automatable, technical impact) were not provided. Net assessment: a credible but not emergency-priority XSS - patch in the normal cycle, prioritized higher for sites with privileged users who could be targeted via the changed scope.

An attacker crafts a URL or page containing a malicious JavaScript payload that is reflected through a MapPress parameter and sends it to a target - for example a WordPress administrator - via email or a forum link. When the victim clicks the link, the script executes in their authenticated browser session, and because scope is changed it can steal session cookies, perform actions as the victim, or pivot toward account takeover. No public proof-of-concept was identified in the provided data.