Description

Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-02T12:17:13.040Z",
  "pubdate": "2026-09-02T12:17:13.040Z",
  "executiveSummary": "The Interactive Geo Maps plugin for WordPress, specifically versions 1.6.30 and below, contains an unauthenticated Cross-Site Scripting (XSS) vulnerability.\nThis flaw allows remote, unauthenticated attackers to inject malicious JavaScript into web pages viewed by other users, including site administrators.\nThe vulnerability arises from improper sanitization or validation of user-supplied input before rendering it in the browser.\nSuccessful exploitation poses a critical risk to the confidentiality, integrity, and availability of the affected site.\nAn attacker can leverage this vulnerability to hijack session cookies, perform unauthorized actions on behalf of authenticated users, modify page content, or redirect victims to malicious external domains.\nAs the exploit does not require authentication, the attack surface is broad, allowing potential targeting by automated bots or opportunistic threat actors.\nImmediate remediation is necessary to prevent unauthorized code execution within the context of the victim's session.",
  "technicalDetails": "The vulnerability is classified as a Stored or Reflected Cross-Site Scripting (XSS) issue resulting from inadequate input sanitization and output escaping within the Interactive Geo Maps plugin.\nThe root cause lies in the plugin's failure to properly sanitize user-provided data, such as map settings, parameter values, or configuration inputs, before echoing them back into the HTML response stream generated by the server.\nBecause the plugin processes these inputs without utilizing appropriate WordPress security APIs—such as sanitize_text_field(), esc_html(), or esc_js()—an attacker can inject arbitrary script tags or event handlers into the page source.\nThe exploitation flow begins with an attacker crafting a malicious payload containing JavaScript, typically delivered via a manipulated request to the plugin’s functional endpoints or configuration interfaces.\nWhen a victim, particularly an administrative user with elevated privileges, accesses the page where the map is rendered, the browser executes the injected script as if it originated from the legitimate web server.\nSince the script executes within the victim's browser context, it inherits the victim's session permissions, enabling the execution of actions such as user account creation, password changes, or unauthorized plugin configuration modifications.\nFurthermore, the script can access the DOM to exfiltrate sensitive data, such as session tokens stored in document.cookie or CSRF tokens required for secure administrative operations.\nThis vulnerability is particularly severe because it bypasses the need for the attacker to possess prior authentication to the WordPress dashboard, effectively allowing an external entity to gain control over administrative sessions.\nThe flaw affects versions <= 1.6.30, and the lack of proper data handling remains persistent across various configurations of the plugin until patched."
}