CVE-2026-4268
Received Received - Intake
Stored XSS in WP Go Maps Plugin Allows Script Injection

Publication date: 2026-03-18

Last updated on: 2026-03-18

Assigner: Wordfence

Description
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the β€˜wpgmza_custom_js’ parameter in all versions up to, and including, 10.0.05 due to insufficient input sanitization and output escaping and missing capability check in the 'admin_post_wpgmza_save_settings' hook anonymous function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-18
Last Modified
2026-03-18
Generated
2026-05-07
AI Q&A
2026-03-18
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
wp_go_maps wp_go_maps to 10.0.05 (inc)
wp_google_maps wp_google_maps to 10.0.05 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

[{'type': 'paragraph', 'content': "The vulnerability CVE-2026-4268 affects the WP Go Maps (formerly WP Google Maps) WordPress plugin, specifically in versions up to and including 10.0.05. It is a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization and output escaping of the 'wpgmza_custom_js' parameter. Additionally, there is a missing capability check in the 'admin_post_wpgmza_save_settings' hook anonymous function."}, {'type': 'paragraph', 'content': 'This flaw allows authenticated attackers with Subscriber-level access or higher to inject arbitrary web scripts into pages. These scripts execute whenever any user accesses the injected page, potentially compromising site security.'}, {'type': 'paragraph', 'content': "The issue was related to missing permission checks on notice actions within the plugin's settings page, allowing low-level users to perform privileged actions. The vulnerability was addressed by adding proper permission checks and improving input validation and sanitization."}] [1]


How can this vulnerability impact me? :

This vulnerability can allow an attacker with low-level authenticated access (Subscriber-level or above) to inject malicious scripts into the website. These scripts execute in the context of users visiting the affected pages, potentially leading to unauthorized actions such as stealing user credentials, session hijacking, or performing actions on behalf of users.

Because the vulnerability involves Stored Cross-Site Scripting, the malicious code persists on the site and affects all users who access the injected content, increasing the risk and impact.

The CVSS v3.1 base score of 6.4 indicates a medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity but not availability.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

I don't know


How can this vulnerability be detected on my network or system? Can you suggest some commands?

[{'type': 'paragraph', 'content': "This vulnerability involves the WP Go Maps WordPress plugin allowing Stored Cross-Site Scripting via the 'wpgmza_custom_js' parameter due to insufficient input sanitization and missing capability checks."}, {'type': 'paragraph', 'content': 'Detection can focus on identifying if the vulnerable plugin version (up to 10.0.05) is installed and active on your WordPress site.'}, {'type': 'paragraph', 'content': 'You can check the plugin version via WP-CLI with the following command:'}, {'type': 'list_item', 'content': 'wp plugin list --status=active | grep wp-google-maps'}, {'type': 'paragraph', 'content': "To detect potential exploitation attempts, monitor HTTP POST requests to the 'admin_post_wpgmza_save_settings' endpoint containing the 'wpgmza_custom_js' parameter with suspicious or unexpected JavaScript code."}, {'type': 'paragraph', 'content': 'For example, using command-line tools like grep on web server logs:'}, {'type': 'list_item', 'content': "grep 'admin_post_wpgmza_save_settings' /var/log/apache2/access.log | grep 'wpgmza_custom_js'"}, {'type': 'paragraph', 'content': 'Additionally, scanning for stored XSS payloads in pages generated by the plugin can be done by reviewing page source or using automated web vulnerability scanners targeting stored XSS.'}] [1]


What immediate steps should I take to mitigate this vulnerability?

[{'type': 'paragraph', 'content': 'The primary mitigation step is to update the WP Go Maps (formerly WP Google Maps) plugin to a version later than 10.0.05 where the vulnerability has been fixed.'}, {'type': 'paragraph', 'content': 'If immediate updating is not possible, restrict access to the WordPress admin area to trusted users only, especially limiting Subscriber-level and above users from accessing plugin settings.'}, {'type': 'paragraph', 'content': "Implement additional security measures such as Web Application Firewalls (WAF) to block suspicious POST requests to 'admin_post_wpgmza_save_settings' containing malicious scripts."}, {'type': 'paragraph', 'content': 'Review and harden user permissions to ensure that only trusted users have the capability to modify plugin settings.'}, {'type': 'paragraph', 'content': 'Monitor logs for suspicious activity related to this plugin and consider temporarily disabling the plugin if exploitation is suspected and patching is delayed.'}] [1]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart