Interactive Geo Maps
Monthly
Reflected Cross-Site Scripting in the Interactive Geo Maps WordPress plugin (versions <= 1.6.30) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to click a crafted URL. The vulnerability carries a CVSS 7.1 with scope change, meaning the injected script executes in the context of the victim's authenticated WordPress session rather than the plugin's own origin. No public exploit or active CISA KEV listing has been identified at time of analysis, though Patchstack has published a vulnerability entry.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parameter in versions up to, and including, 1.5.9 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Reflected Cross-Site Scripting in the Interactive Geo Maps WordPress plugin (versions <= 1.6.30) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to click a crafted URL. The vulnerability carries a CVSS 7.1 with scope change, meaning the injected script executes in the context of the victim's authenticated WordPress session rather than the plugin's own origin. No public exploit or active CISA KEV listing has been identified at time of analysis, though Patchstack has published a vulnerability entry.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parameter in versions up to, and including, 1.5.9 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.