WP Mapa Politico Espana < 3.7.0- Authenticated Stored XSS
Priority LOW 23CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Why it matters now
EPSS 0.00617 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WP Mapa Politico España (Unknown): 3.7.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | WP Mapa Politico España | 3.7.0 to before 3.7.0 | 3.7.0 | Patch available | CNA |
- WP Mapa Politico España VendorUnknown Affected 3.7.0 to before 3.7.0 Fixed in 3.7.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wp_mapa_politico_espana_project:wp_mapa_politico_espana:*:*:*:*:*:wordpress:*:* | before 3.7.0 | Vulnerable | Wp Mapa Politico Espana Project |
- cpe:2.3:a:wp_mapa_politico_espana_project:wp_mapa_politico_espana:*:*:*:*:*:wordpress:*:* Versions before 3.7.0 Vulnerable ·Wp Mapa Politico Espana Project
Remediation
- Fix · CNA WP Mapa Politico España (Unknown) Fixed in 3.7.0
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24609
- 2026-10-03 Alias added: GHSA-542c-p7pq-534w
References
Sources
- CVE-2021-24609 · CVE Program
- CVE-2021-24609 · NVD
- FIRST EPSS
- GHSA-542c-p7pq-534w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences