WP Map Block < 1.2.3 - Contributor+ Stored Cross-Site Scripting

The plugin does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks

PoC

- As a contributor, add a WP Map Block to a post/page - Click “Show more settings” - Scroll the sidebar and click “Map Marker” - Click “Marker 1” - Paste the following as “Title”: ’ style=‘animation-name:twentytwentyone-close-button-transition’ onanimationend=‘alert(origin)’ - Save and view/preview to trigger the XSS (the payload is specific to the TwentyTwentyOne theme but could be changed)