CVE-2019-9912

MEDIUMNuclei

WP Google Maps < 7.10.43 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2019-9912 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMWP Google Maps < 7.10.43 - Cross-Site ScriptingCVSS 6.1

The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.

Impact

Attackers can execute arbitrary scripts in the admin context, potentially leading to session hijacking or privilege escalation.

Remediation

Update to version 7.10.43 or later.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2019wpwp-pluginwordpressxsswp-go-mapsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:wpgmaps:wp_go_maps:*:*:*:*:*:wordpress:*:*
FOFA: body="/wp-content/plugins/wp-google-maps"
https://lists.openwall.net/full-disclosure/2019/02/05/13 https://security-consulting.icu/blog/2019/02/wordpress-wpgooglemaps-xss/ https://nvd.nist.gov/vuln/detail/CVE-2019-9912

Source: ProjectDiscovery

References

4