PT-2014-7820 · WordPress · Wp Google Maps

Published 2014-10-22 · Updated 2023-05-26 · CVE-2014-7182

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WP Google Maps plugin versions prior to 6.0.27

Description The issue allows remote attackers to inject arbitrary web script or HTML via the poly id parameter in an edit poly, edit polyline, or edit marker action in the "wp-google-maps-menu" page to "wp-admin/admin.php". This can be achieved through API endpoints such as "/wp-admin/admin.php" with specific actions.

Recommendations For WP Google Maps plugin versions prior to 6.0.27, update to version 6.0.27 or later to resolve the issue. As a temporary workaround, consider restricting access to the edit poly, edit polyline, and edit marker actions in the wp-google-maps-menu page to minimize the risk of exploitation. Avoid using the poly id parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-7182

Affected Products

Wp Google Maps

References · 7

• 🔥 http://packetstormsecurity.com/files/128694/WordPress-WP-Google-Maps-6.0.26-Cross-Site-Scripting.html · Exploit
• 🔥 https://htbridge.com/advisory/HTB23236 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-7182 · Security Note
• https://wordpress.org/plugins/wp-google-maps/changelog · Note
• http://securityfocus.com/bid/70597 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7182 · Note
• http://securityfocus.com/archive/1/533699/100/0/threaded · Note