VDB
CVE-2023-5744
CVE-2023-5744
PUBLISHED
CVSS 6.400000095367432 MEDIUM
The Very Simple Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vsgmap' shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
EPSS 0.60% · 47.3th percentile
Risk Scores
CVSS 3.1
6.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS Score
0.60%
47.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| very_simple_google_maps_project | very_simple_google_maps | 0, 0 |
| masterk | Very Simple Google Maps | *, 0 |
Timeline
- Oct 24, 2023 CVE Published
- Oct 25, 2023 EPSS Score
- Nov 25, 2023 EPSS Score
- Dec 27, 2023 EPSS Score
- Jan 27, 2024 EPSS Score
- Mar 30, 2024 EPSS Score
- Apr 30, 2024 EPSS Score
- Jun 1, 2024 EPSS Score
- Jul 2, 2024 EPSS Score
- Aug 2, 2024 EPSS Score
- Sep 3, 2024 EPSS Score
- Oct 4, 2024 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-5744 advisory
- https://plugins.trac.wordpress.org/browser/very-simple-google-maps/trunk/very-simple-google-maps.php?rev=2941389#L22 url
- https://plugins.trac.wordpress.org/changeset/2982539/very-simple-google-maps#file1 url
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fca7837c-ad24-44ce-b073-7df3f8bc4300?source=cve advisory