EUVD-2026-39687
GHSA-78f6-5jm4-f832
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated reflected XSS reachable over the network with low complexity (PR:N/AC:L) but needs victim click (UI:R); injected script crosses into the site's trusted context (S:C) with limited C/I/A impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions.
Articles & Coverage 1
AnalysisAI
Reflected/stored Cross-Site Scripting in the MapPress Maps for WordPress plugin (versions 2.97.3 and earlier) allows an unauthenticated remote attacker to inject malicious JavaScript that executes in the browser of a victim who interacts with a crafted link or page. Because the CVSS scope is changed (S:C), the injected script can act beyond the vulnerable component to affect logged-in users including administrators. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
The affected component is MapPress Maps for WordPress, a popular WordPress plugin that embeds Google Maps and Leaflet maps via shortcodes and a custom map editor. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected or stored into HTML output without adequate output encoding or input sanitization, so an attacker-supplied payload is interpreted as active script by the browser. The CVSS vector's PR:N indicates the injection path is reachable without authentication, and the changed scope (S:C) is consistent with script executing in the trusted security context of the WordPress site (the browser DOM/session) rather than only within the plugin's own boundary. No CPE strings were supplied in the input; the affected product and version ceiling are derived from the Patchstack/NVD description.
RemediationAI
Upgrade the MapPress Maps for WordPress plugin to the first release published after 2.97.3 (the input does not specify an exact fixed version, so confirm the patched build via the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mappress-google-maps-for-wordpress/vulnerability/wordpress-mappress-maps-for-wordpress-plugin-2-97-3-cross-site-scripting-xss-vulnerability before deploying). If immediate patching is not possible, place a Web Application Firewall rule (for example Patchstack vPatch, Wordfence, or ModSecurity) in front of the site to filter script-injection patterns on the plugin's request parameters; note this can produce false positives on legitimate map content. As an additional compensating control, restrict or temporarily disable the MapPress shortcode/editor functionality on public-facing pages and review map data fields for already-injected payloads, accepting the trade-off that embedded maps will stop rendering until the plugin is updated.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today