EUVD-2026-60790
GHSA-p37p-gp6p-9q27
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network XSS with Changed scope requires victim interaction; no direct availability impact identified for a map-embed plugin.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
AnalysisAI
Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered in a victim's browser. The CVSS vector confirms a Changed scope (S:C), meaning injected scripts execute within the victim's browser security context rather than the plugin's own origin, enabling session hijacking or malicious redirection against authenticated WordPress users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have the Ultimate Maps by Supsystic plugin installed and active at a version below 1.5.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 (High) score is driven by the network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N) attack requiring only victim interaction (UI:R) and achieving a Changed scope (S:C). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running the Ultimate Maps by Supsystic plugin at a version below 1.5.0, then crafts a URL or page input that embeds a JavaScript payload in an unsanitized plugin parameter. The attacker delivers this crafted URL to a logged-in WordPress administrator via phishing or a malicious external link; when the administrator loads the page, the injected script executes in their browser, exfiltrating their session cookie or performing privileged WordPress actions on their behalf. … |
| Remediation | Update the Ultimate Maps by Supsystic plugin to version 1.5.0 or later immediately, as this release is confirmed by Patchstack to resolve the XSS vulnerability (https://patchstack.com/database/wordpress/plugin/ultimate-maps-by-supsystic/vulnerability/wordpress-ultimate-maps-by-supsystic-plugin-1-5-0-cross-site-scripting-xss-vulnerability). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations to identify deployment of the Ultimate Maps by Supsystic plugin and assess the business criticality of affected sites. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ultimate Maps By Supsystic
View allUnauthenticated PHP Object Injection in the Ultimate Maps by Supsystic WordPress plugin (all versions before 1.5.0) lets
Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenti
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today