PT-2022-7146 · WordPress · Mappress Maps

Krzysztof Zając · Published 2022-01-17 · Updated 2022-02-22 · CVE-2022-0208

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MapPress Maps for WordPress versions prior to 2.73.4

Description The issue arises from the failure to sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting attack. This vulnerability can be exploited by a remote attacker to conduct an inter-site scripting attack.

Recommendations For versions prior to 2.73.4, update to version 2.73.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the mapid parameter in the affected API endpoint until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-07859

CVE-2022-0208

Affected Products

Mappress Maps

References · 5

• 🔥 https://wpscan.com/vulnerability/59a2abd0-4aee-47aa-ad3a-865f624fa0fc · Exploit
• https://osv.dev/vulnerability/CVE-2022-0208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0208 · Security Note
• https://bdu.fstec.ru/vul/2023-07859 · Security Note
• https://t.me/cibsecurity/37401 · Telegram Post