WP Map Block <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The WP Map Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Marker field in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary...
- CVSS:
- 6.4
- Affected:
- up to 2.0.2
- Fixed in:
- 2.0.3
- Disclosed:
- Jun 6, 2025
CVE-2025-5194 on NVD →
WP Map Block – Gutenberg Map Block for Google Map and OpenStreet Map <= 1.2.2 - Stored Cross-Site Scripting
medium
The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
- CVSS:
- 5.4
- Affected:
- up to 1.2.3
- Fixed in:
- 1.2.3
- Disclosed:
- Aug 25, 2021
CVE-2021-24643 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database