Description

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T15:17:05.270Z",
  "pubdate": "2026-08-18T15:17:05.270Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Ultimate Maps by Supsystic plugin for versions prior to 1.5.0.\nThe vulnerability allows unauthenticated remote attackers to inject malicious JavaScript payloads into the application, which are subsequently executed within the context of a victim's browser session.\nSuccessful exploitation of this flaw can lead to unauthorized actions performed on behalf of the user, session hijacking, credential theft, and redirection to malicious external sites.\nThe risk implication is high, as it affects web applications utilizing vulnerable versions of the product without requiring any prior authentication or special privileges from the attacker.\nExploitation requires network access to the target web application and relies on tricking a user into interacting with a crafted request or navigating to a malicious URL.",
  "technicalDetails": "The root cause of the vulnerability stems from improper neutralization of user-supplied input prior to rendering it back to the client, failing to implement adequate context-aware output encoding or sanitization mechanisms within the Ultimate Maps by Supsystic plugin.\nThe vulnerable component involves input handling routines in versions prior to 1.5.0, where parameters processed by the plugin are reflected directly into the Document Object Model (DOM) without prior validation.\nThe attack flow begins when an unauthenticated attacker crafts a malicious HTTP request containing arbitrary JavaScript payloads embedded within vulnerable parameters handled by the plugin.\nBecause the application lacks proper input sanitization and output encoding, the injected payload is reflected in the HTTP response returned to any user who accesses the crafted URL.\nWhen a victim interacts with the malicious link, the browser processes the response and executes the injected script within the security context of the victim's current session.\nThe payload behavior can range from executing benign client-side checks to exfiltrating sensitive session cookies, DOM manipulation, or performing unauthorized administrative actions if an authenticated administrator falls victim to the exploit.\nThe vulnerability requires no authentication or privileges, meaning any remote attacker with network exposure to the vulnerable web application can initiate the attack vector."
}