VDB
CVE-2024-13306
CVE-2024-13306
PUBLISHED
CVSS 9.300000190734863 CRITICAL
The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
EPSS 0.32% · 25.6th percentile
Risk Scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.32%
25.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| wpgooglemap | wp_google_map | 0, 0 |
| Unknown | Maps Plugin using Google Maps for WordPress | 0, 0 |
Timeline
- Feb 15, 2025 Coalition ESS Score
- Feb 15, 2025 CVE Published
- Feb 15, 2025 PoC Published
- Feb 15, 2025 PoC Published
- Feb 15, 2025 PoC Published
- Feb 15, 2025 PoC Published
- Feb 15, 2025 PoC Published
- Feb 15, 2025 PoC Published
- Feb 15, 2025 PoC Published
- Feb 16, 2025 EPSS Score
- Feb 18, 2025 Coalition ESS Score
- Feb 18, 2025 CVE Updated