VDB
CVE-2023-2899
CVE-2023-2899
PUBLISHED
CVSS 9.300000190734863 CRITICAL
The Google Map Shortcode WordPress plugin through 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
EPSS 0.44% · 38.0th percentile
Risk Scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.44%
38.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| web-argument | google_map_shortcode | 0, 0 |
| Unknown | Google Map Shortcode | 0, 0 |
Timeline
- Jun 19, 2023 CVE Published
- Jun 19, 2023 PoC Published
- Jun 20, 2023 EPSS Score
- Jul 26, 2023 EPSS Score
- Aug 30, 2023 EPSS Score
- Oct 5, 2023 EPSS Score
- Nov 10, 2023 EPSS Score
- Jan 20, 2024 EPSS Score
- Feb 25, 2024 EPSS Score
- Apr 1, 2024 EPSS Score
- May 6, 2024 EPSS Score
- Jun 11, 2024 EPSS Score