Description
The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | MapPress Maps for WordPress | < 2.94.9 | 2.94.9 |
References
- https://wpscan.com/vulnerability/a8bfdbbf-6963-4fab-826a-6be770ac72c3/ exploit vdb-entry technical-description