WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
Why it matters now
EPSS 0.02467 84th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed WP Google Maps (WP Google Maps): 8.1.12
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WP Google Maps | WP Google Maps | 8.1.12 to before 8.1.12 | 8.1.12 | Patch available | CNA |
- WP Google Maps VendorWP Google Maps Affected 8.1.12 to before 8.1.12 Fixed in 8.1.12 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:codecabin:wp_go_maps:*:*:*:*:*:wordpress:*:* | before 8.1.12 | Vulnerable | Code Cabin Inc |
- cpe:2.3:a:codecabin:wp_go_maps:*:*:*:*:*:wordpress:*:* Versions before 8.1.12 Vulnerable ·Code Cabin Inc
Remediation
- Fix · CNA WP Google Maps (WP Google Maps) Fixed in 8.1.12
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24383
- 2026-10-03 Alias added: GHSA-hgx6-w8x6-xmxw
References
More Code Cabin Inc Wp Go Maps vulnerabilities
- TI-2019-07981 In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in… CVSS 3.1CRITICAL 9.8
- TI-2024-19698 WordPress WP Go Maps plugin <= 9.0.29 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
- TI-2023-06074 WP Go Maps < 9.0.28 - Unauthenticated Stored XSS CVSS 3.1MEDIUM 6.1
- TI-2025-18459 WordPress WP Google Maps plugin <= 9.0.40 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
- TI-2023-06192 WP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Service CVSS 3.1MEDIUM 6.5
- TI-2019-07284 The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO. CVSS 3.1MEDIUM 6.1
Sources
- CVE-2021-24383 · CVE Program
- CVE-2021-24383 · NVD
- FIRST EPSS
- GHSA-hgx6-w8x6-xmxw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences