CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1.11). Vulnerable parameters: &wpgmaps_marker_category_name, Value > &attributes[], Name > &attributes[], &icons[], &names[], &description, &link, &title.
Explanation of Vulnerability in Simple Terms
WP Google Maps Pro version 8.1.11 contains a cross-site scripting (XSS) vulnerability that allows high-privilege users to inject malicious scripts affecting other users or the site. The vulnerability requires administrator-level access to exploit. The injected code can modify page content or steal session data from visitors.
What an attacker can do
Inject malicious JavaScript that executes in other users' browsers and affects site functionality.
Potential impact on your site
A compromised admin account can inject persistent malicious code affecting all site visitors and data integrity.
Conditions required to exploit
Attacker must have administrator or high-privilege account access to the WordPress site.
Key dates
External resources
Related vulnerabilities
