VDB
CVE-2024-5219
CVE-2024-5219
PUBLISHED
CVSS 6.400000095367432 MEDIUM
The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and including, 1.11.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
EPSS 0.34% · 27.7th percentile
Risk Scores
CVSS 3.1
6.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS Score
0.34%
27.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| supsysticcom | Easy Google Maps | *, 0 |
| supsystic | easy_google_maps | 0, 0 |
| supsystic | easy_google_maps | 0, 0 |
Timeline
- Jul 2, 2024 EPSS Score
- Jul 2, 2024 CVE Published
- Jul 25, 2024 EPSS Score
- Aug 16, 2024 EPSS Score
- Sep 8, 2024 EPSS Score
- Oct 5, 2024 Coalition ESS Score
- Oct 23, 2024 EPSS Score
- Nov 15, 2024 EPSS Score
- Dec 8, 2024 EPSS Score
- Dec 31, 2024 EPSS Score
- Jan 22, 2025 EPSS Score
- Feb 14, 2025 EPSS Score
References
- https://plugins.trac.wordpress.org/changeset/3105921/ patch
- https://nvd.nist.gov/vuln/detail/CVE-2024-5219 advisory
- https://plugins.trac.wordpress.org/browser/google-maps-easy/tags/1.11.15/modules/icons/mod.php url
- https://plugins.trac.wordpress.org/changeset/3105921 url
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4af9c623-1539-4afc-9dcd-3f97d29aa4f3?source=cve url