Description Preview
The WP Google Maps WordPress plugin before 8.1.12 contains a stored Cross-Site Scripting (XSS) vulnerability. The plugin fails to properly sanitize, validate, or escape the Map Name when it's displayed in the Map List of the admin dashboard. This allows authenticated users to inject malicious JavaScript code that executes when administrators view the Map List page.
Overview
This vulnerability (CVE-2021-24383) is classified as CWE-79 (Cross-Site Scripting) and affects the WP Google Maps WordPress plugin versions prior to 8.1.12. The issue stems from improper output handling of the Map Name parameter in the admin dashboard's Map List section. An authenticated attacker could create a map with a specially crafted name containing malicious JavaScript code. When an administrator views the list of maps in the dashboard, the injected code would execute within their browser session, potentially allowing the attacker to perform actions with administrator privileges, steal sensitive information, or redirect users to malicious websites.
Remediation
To address this vulnerability, website administrators should:
- Update the WP Google Maps plugin to version 8.1.12 or later immediately.
- Review existing maps for any suspicious names that might contain JavaScript code.
- Implement the principle of least privilege by limiting which users have permissions to create or edit maps.
- Consider using a Web Application Firewall (WAF) that can help detect and block XSS attacks.
- Regularly audit and update all WordPress plugins to their latest versions.
References
- Packet Storm Security Advisory: http://packetstormsecurity.com/files/163261/WordPress-WP-Google-Maps-8.1.11-Cross-Site-Scripting.html
- WPScan Vulnerability Database: https://wpscan.com/vulnerability/1270588c-53fe-447e-b83c-1b877dc7a954
- Common Weakness Enumeration: CWE-79 (Cross-site Scripting)
- Official WordPress Plugin Repository: https://wordpress.org/plugins/wp-google-maps/
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
