CVE-2019-9912

MEDIUM NUCLEI

WP Google Maps < 7.10.43 - Cross-Site Scripting via PATH_INFO

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2019-9912 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.

Nuclei Templates (1)

WP Google Maps < 7.10.43 - Cross-Site Scripting
MEDIUMVERIFIEDby ritikchaddha
FOFA: body="/wp-content/plugins/wp-google-maps"

References (3)

Core 3
Core References
Exploit, Mailing List, Third Party Advisory x_refsource_misc
https://lists.openwall.net/full-disclosure/2019/02/05/13
Exploit, Third Party Advisory x_refsource_misc
https://security-consulting.icu/blog/2019/02/wordpress-wpgooglemaps-xss/
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2019/Mar/41

Scores

CVSS v3 6.1
EPSS 0.0303
EPSS Percentile 85.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
codecabin/wp_go_maps < 7.10.43
Published Mar 22, 2019
Tracked Since Feb 18, 2026