CVEvulnerability
CVE-2023-6627
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2024-01-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attackers can abuse to store malicious HTML/Javascript on the site.
Affected configurations
• codecabin wp go maps (< 9.0.28)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://wpscan.com/blog/stored-xss-fixed-in-wp-go-maps-9-0-28/ Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/f5687d0e-98ca-4449-98d6-7170c97c8f54 Exploit, Third Party Advisory
- https://wpscan.com/blog/stored-xss-fixed-in-wp-go-maps-9-0-28/ Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/f5687d0e-98ca-4449-98d6-7170c97c8f54 Exploit, Third Party Advisory