WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)

2021-06-0700:00:00

Mohammed Adam

322

0.001 Low

EPSS

Percentile

41.2%

JSON

The plugin did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue Note: The vendor attributed the issue in the changelog to the wrong reporter (us, WPScan, as we reported it on behalf of the reporter). This will be corrected in the next version

Steps to Reproduce:

1) Edit a map (e.g /wp-admin/admin.php?page=wp-google-maps-menu&action=edit&map_id=1)
2) Change Map Name to <script>alert(document.cookie)</script>
3) Save the Map
4) Stored XSS will be triggered when viewing the Map List (/wp-admin/admin.php?page=wp-google-maps-menu)

POC Screenshots attached in dropbox link: https://www.dropbox.com/s/z4gc6386xcm83vm/Stored%20xss%20in%20WP%20Googlemaps.zip?dl=0

0.001 Low

EPSS

Percentile

41.2%

JSON

Related for WPEX-ID:1270588C-53FE-447E-B83C-1B877DC7A954