{"id":"CVE-2024-0420","state":"PUBLISHED","title":"MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSS","description":"The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks","publishedAt":"2024-02-12T16:05:58.767Z","updatedAt":"2024-10-27T22:09:18.545Z","severity":{"score":6.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown MapPress Maps for WordPress"],"affected":[{"vendor":"Unknown","product":"MapPress Maps for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.88.15","versionType":"semver"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://wpscan.com/vulnerability/b6187ef8-70f4-4911-abd7-42bf6b7e54b7/"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/0xxx/CVE-2024-0420.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-0420","state":"PUBLISHED","datePublished":"2024-02-12T16:05:58.767Z","dateUpdated":"2024-10-27T22:09:18.545Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2024-01-11T11:30:33.280Z"},"containers":{"cna":{"title":"MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSS","descriptions":[{"lang":"en","value":"The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks"}],"affected":[{"vendor":"Unknown","product":"MapPress Maps for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.88.15","versionType":"semver"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://wpscan.com/vulnerability/b6187ef8-70f4-4911-abd7-42bf6b7e54b7/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-79 Cross-Site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2024-02-12T16:07:32.748Z"},"credits":[{"lang":"en","value":"Salvatore Bova","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"mappresspro","product":"mappress_maps","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"2.88.15","versionType":"custom"}],"cpes":["cpe:2.3:a:mappresspro:mappress_maps:-:*:*:*:*:wordpress:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-10-27T22:08:20.926267Z","id":"CVE-2024-0420","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-27T22:09:18.545Z"}},{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/b6187ef8-70f4-4911-abd7-42bf6b7e54b7/","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:04:49.657Z"}}]}}}