6.1
CVE-2024-0420
- EPSS 0.2%
- Veröffentlicht 12.02.2024 16:15:08
- Zuletzt bearbeitet 21.11.2024 08:46:32
- Quelle contact@wpscan.com
- CVE-Watchlists
- Unerledigt
LoginMapPress Maps for WordPress <= 2.88.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks
Mögliche Gegenmaßnahme
MapPress Maps for WordPress: Update to version 2.88.15, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
MapPress Maps for WordPress
Version
*-2.88.14
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mappresspro ≫ Mappress Maps For Wordpress SwPlatformwordpress Version < 2.88.15
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.2% | 0.418 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.4 | 2.3 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.