CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps plugin (versions <= 8.1.12). Vulnerable parameters: &dataset_name, &wpgmza_gdpr_retention_purpose, &wpgmza_gdpr_company_name, &name #2, &name, &polyname #2, &polyname, &address.
Explanation of Vulnerability in Simple Terms
WP Google Maps version 8.1.12 contains a stored cross-site scripting (XSS) vulnerability that allows high-privilege users to inject malicious scripts. When executed, these scripts run in the browsers of other site visitors, potentially compromising their sessions or stealing data. The vulnerability affects the plugin's scope across the site.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers when they view affected pages.
Potential impact on your site
Compromised admin accounts can inject persistent malware affecting all site visitors and their data.
Conditions required to exploit
Attacker must have high-level WordPress privileges (administrator or equivalent role).
Key dates
External resources
Related vulnerabilities
