MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSS

2024-01-1700:00:00

Salvatore Bova

mappress

wordpress

contributor

stored xss

dashboard

exploit

5.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Description The plugin does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks

As a contributor, create/edit a map with the below payload as title and attach it to a post (can be done in the post dashboard in the Map column)

<script>alert(/XSS/)</script>

The XSS will be triggered when anyone access the post dashboard (/wp-admin/edit.php?post_type=post)