VDB
CVE-2024-13542
CVE-2024-13542
PUBLISHED
CVSS 6.400000095367432 MEDIUM
The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgsv' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
EPSS 0.25% · 16.1th percentile
Risk Scores
CVSS 3.1
6.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS Score
0.25%
16.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| agenceseo | wp_google_street_view | 0, 0 |
| pagup | WP Google Street View (with 360° virtual tour) & Google maps + Local SEO | *, 0 |
Timeline
- Jan 24, 2025 CVE Published
- Jan 24, 2025 PoC Published
- Jan 24, 2025 PoC Published
- Jan 25, 2025 EPSS Score
- Feb 6, 2025 PoC Published
- Feb 9, 2025 EPSS Score
- Feb 25, 2025 EPSS Score
- Mar 9, 2025 Coalition ESS Score
- Mar 12, 2025 EPSS Score
- Mar 28, 2025 EPSS Score
- Apr 12, 2025 EPSS Score
- Apr 27, 2025 EPSS Score
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4b1944a9-4bc4-4ac2-83c3-55d6d61f405c?source=cve url
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227140%40wp-google-street-view&new=3227140%40wp-google-street-view&sfp_email=&sfph_mail= url
- https://nvd.nist.gov/vuln/detail/CVE-2024-13542 advisory