Description

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapes_values Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fc-call-nonce nonce required by the endpoint is exposed to all frontend visitors who view a map page via window.wpgmp_local.nonce, enabling any authenticated subscriber to read the nonce and craft a valid request; additionally, the secondary _wpnonce check in the drawing handler can be bypassed by simply omitting the _wpnonce parameter from the request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-25T08:16:39.820Z",
  "pubdate": "2026-09-25T08:16:39.820Z",
  "executiveSummary": "The WP Maps plugin for WordPress, up to version 4.9.8, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw arises from inadequate input sanitization and output escaping within the shapes_values parameter.\nThe vulnerability allows authenticated attackers with subscriber-level privileges or higher to inject arbitrary JavaScript into the application. This malicious payload executes within the context of the victim's browser whenever they access a page containing the injected map content.\nExploitation is facilitated by the exposure of the fc-call-nonce to all frontend users through the window.wpgmp_local.nonce object. Furthermore, the vulnerability is compounded by a flaw in the drawing handler's security checks, where the secondary _wpnonce validation can be bypassed by omitting the parameter entirely.\nSuccessful exploitation enables an attacker to perform unauthorized actions on behalf of the victim, potentially leading to administrative account compromise, session hijacking, or the distribution of malicious content across the site. The combination of easy nonce retrieval and flawed access control renders the application highly vulnerable to malicious script injection.",
  "technicalDetails": "The root cause of this Stored XSS vulnerability is the failure of the WP Maps plugin to perform rigorous input validation and context-aware output encoding on the shapes_values parameter. This parameter is used by the plugin to store map drawing configurations. By injecting malicious script tags or event handlers into this input field, an attacker can ensure the browser interprets the input as executable code.\nThe attack flow begins with the attacker identifying the globally accessible nonce, fc-call-nonce, which is exposed in the frontend via the window.wpgmp_local.nonce JavaScript object. This exposure removes the intended cryptographic barrier for authenticated users to interact with sensitive endpoints.\nOnce the attacker obtains the nonce, they craft a request to the plugin's drawing handler. Due to a logical flaw in the server-side validation logic, the secondary _wpnonce check is implemented such that it can be completely bypassed by omitting the parameter from the HTTP request. This effectively invalidates the CSRF protection intended for the drawing handler endpoint.\nThe authenticated attacker submits a POST request containing the malicious JavaScript payload within the shapes_values field. Because the backend fails to sanitize this input before persisting it to the database, the payload is stored. When a user, such as an administrator, navigates to a page where the map renders, the server reflects the unsanitized shapes_values data. The victim's browser then executes the injected script.\nThe impact of this execution is severe. Since the script runs in the context of the victim's session, the attacker can perform actions that the user is authorized to perform, including modifying site settings, creating new administrative users, or scraping sensitive data. If the victim has higher privileges, the attacker can achieve full site compromise. This vulnerability is present in all versions up to and including 4.9.8, affecting users with at least subscriber-level authentication. The attack does not require advanced network positioning, relying solely on the application's internal trust boundaries."
}