Peprodev Branches Map Mapify
Monthly
Stored cross-site scripting in the PeproDev Branches Map (Mapify) WordPress plugin affects every release up to and including 3.0.1, allowing an authenticated attacker holding Contributor-level or higher privileges to save script payloads into plugin-handled page or map content that are later rendered without escaping. The injected script then executes in the browser of any user - including administrators and ordinary visitors - who views the compromised page, yielding a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and a scope change that pushes impact beyond the vulnerable component into the wider WordPress session context. Exploitation requires a valid low-privileged authoring account plus a separate victim viewing the poisoned page; on sites with open registration or loosely granted contributor roles that prerequisite is easy to satisfy, and no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in the PeproDev Branches Map (Mapify) WordPress plugin affects every release up to and including 3.0.1, allowing an authenticated attacker holding Contributor-level or higher privileges to save script payloads into plugin-handled page or map content that are later rendered without escaping. The injected script then executes in the browser of any user - including administrators and ordinary visitors - who views the compromised page, yielding a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and a scope change that pushes impact beyond the vulnerable component into the wider WordPress session context. Exploitation requires a valid low-privileged authoring account plus a separate victim viewing the poisoned page; on sites with open registration or loosely granted contributor roles that prerequisite is easy to satisfy, and no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).