MapifyLite and MapifyPro <= 3.3 - Authenticated Stored Cross-Site Scripting
medium
The MapifyLite and MapifyPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an inj...
- CVSS:
- 6.4
- Affected:
- up to 3.3
- Fixed in:
- 4.0.0
- Disclosed:
- Mar 24, 2021
MapifyLite (by MapifyPro) [mapifylite] <= 3.3.0 (unfixed)
unknown
Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Eagle Eye in WordPress MapifyLife plugin (versions <= 3.3.0).
- Affected:
- up to 3.3.0
- Fix:
- No patched version reported
- Disclosed:
- Mar 24, 2021
MapifyLite (by MapifyPro) [mapifylite] < 4.0.0
unknown
The MapifyLite and MapifyPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an inj...
- Affected:
- up to 4.0.0
- Fixed in:
- 4.0.0
- Disclosed:
- Mar 24, 2021
MapifyLite (by MapifyPro) [mapifylite] < 4.0.0
unknown
The plugin does not sanitise the Image URL (either in the settings or in a location), allowing editor+ users to use a malicious payload, leading to Stored Cross-Site Scripting issues.
Notes (WPScanTeam):
- The vendor has been notified on March 24th, 2021
- April 3rd, 2021 - v4.0.0 released of MapifyLite and Mapify...
- Affected:
- up to 4.0.0
- Fixed in:
- 4.0.0
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database