CVE-2026-56011

HIGH EXPLOITED LAB

WordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerability

Title source: cna
STIX 2.1

Exploitation Summary

CVE-2026-56011 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including rootdirective-sec.

AI-analyzed exploit summary This repository provides a detailed technical analysis and Docker-based lab for CVE-2026-56011, an unauthenticated XSS vulnerability in MapPress Maps for WordPress. It includes a comparison between vulnerable (2.97.3) and patched (2.97.4) versions, demonstrating the root cause and fix.

Description

Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions.

Exploits (1)

github WRITEUP
by rootdirective-sec · dockerfileclient-side
https://github.com/rootdirective-sec/CVE-2026-56011-Lab

This repository provides a detailed technical analysis and Docker-based lab for CVE-2026-56011, an unauthenticated XSS vulnerability in MapPress Maps for WordPress. It includes a comparison between vulnerable (2.97.3) and patched (2.97.4) versions, demonstrating the root cause and fix.

Classification
Writeup 100%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: MapPress Maps for WordPress (versions up to 2.97.3)
No auth needed
Prerequisites: Docker · WordPress environment
mistral-large-3 · analyzed Jul 01, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 7.1
EPSS 0.0024
EPSS Percentile 15.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Lab Environment

COMMUNITY
Community Lab
docker pull wordpress:cli-php8.2
docker pull wordpress:6.8.2-php8.2-apache

Details

VulnCheck KEV 2026-06-19
CWE
CWE-79
Status published
Products (1)
chrisvrichardson/MapPress Maps for WordPress < 2.97.3
Published Jun 26, 2026
Tracked Since Jun 26, 2026