Executive Summary

[{'type': 'paragraph', 'content': "The vulnerability CVE-2026-4268 affects the WP Go Maps (formerly WP Google Maps) WordPress plugin, specifically in versions up to and including 10.0.05. It is a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization and output escaping of the 'wpgmza_custom_js' parameter. Additionally, there is a missing capability check in the 'admin_post_wpgmza_save_settings' hook anonymous function."}, {'type': 'paragraph', 'content': 'This flaw allows authenticated attackers with Subscriber-level access or higher to inject arbitrary web scripts into pages. These scripts execute whenever any user accesses the injected page, potentially compromising site security.'}, {'type': 'paragraph', 'content': "The issue was related to missing permission checks on notice actions within the plugin's settings page, allowing low-level users to perform privileged actions. The vulnerability was addressed by adding proper permission checks and improving input validation and sanitization."}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with low-level authenticated access (Subscriber-level or above) to inject malicious scripts into the website. These scripts execute in the context of users visiting the affected pages, potentially leading to unauthorized actions such as stealing user credentials, session hijacking, or performing actions on behalf of users.

Because the vulnerability involves Stored Cross-Site Scripting, the malicious code persists on the site and affects all users who access the injected content, increasing the risk and impact.

The CVSS v3.1 base score of 6.4 indicates a medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity but not availability.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability involves the WP Go Maps WordPress plugin allowing Stored Cross-Site Scripting via the 'wpgmza_custom_js' parameter due to insufficient input sanitization and missing capability checks."}, {'type': 'paragraph', 'content': 'Detection can focus on identifying if the vulnerable plugin version (up to 10.0.05) is installed and active on your WordPress site.'}, {'type': 'paragraph', 'content': 'You can check the plugin version via WP-CLI with the following command:'}, {'type': 'list_item', 'content': 'wp plugin list --status=active | grep wp-google-maps'}, {'type': 'paragraph', 'content': "To detect potential exploitation attempts, monitor HTTP POST requests to the 'admin_post_wpgmza_save_settings' endpoint containing the 'wpgmza_custom_js' parameter with suspicious or unexpected JavaScript code."}, {'type': 'paragraph', 'content': 'For example, using command-line tools like grep on web server logs:'}, {'type': 'list_item', 'content': "grep 'admin_post_wpgmza_save_settings' /var/log/apache2/access.log | grep 'wpgmza_custom_js'"}, {'type': 'paragraph', 'content': 'Additionally, scanning for stored XSS payloads in pages generated by the plugin can be done by reviewing page source or using automated web vulnerability scanners targeting stored XSS.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'The primary mitigation step is to update the WP Go Maps (formerly WP Google Maps) plugin to a version later than 10.0.05 where the vulnerability has been fixed.'}, {'type': 'paragraph', 'content': 'If immediate updating is not possible, restrict access to the WordPress admin area to trusted users only, especially limiting Subscriber-level and above users from accessing plugin settings.'}, {'type': 'paragraph', 'content': "Implement additional security measures such as Web Application Firewalls (WAF) to block suspicious POST requests to 'admin_post_wpgmza_save_settings' containing malicious scripts."}, {'type': 'paragraph', 'content': 'Review and harden user permissions to ensure that only trusted users have the capability to modify plugin settings.'}, {'type': 'paragraph', 'content': 'Monitor logs for suspicious activity related to this plugin and consider temporarily disabling the plugin if exploitation is suspected and patching is delayed.'}] [1]

Useful 0 Not Useful 0