PT-2026-34307 · WordPress · Posts Map

Nail Majdeddine · Published 2026-04-22 · Updated 2026-05-01 · CVE-2026-6236

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Posts map plugin for WordPress versions prior to 0.1.4

Description Insufficient input sanitization and output escaping on user supplied attributes allow authenticated attackers with contributor-level access and above to inject arbitrary web scripts. This occurs via the 'name' shortcode attribute, resulting in scripts that execute whenever a user accesses an injected page. Stored Cross-Site Scripting is a flaw where a malicious script is permanently stored on the target server.

Recommendations Update the plugin to a version later than 0.1.3.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-6236

Affected Products

Posts Map

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-6236 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e02c5817-7a54-4958-a076-71e5e7729cda?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2046909790928990537 · Twitter Post
• https://reddit.com/r/StopBadBots/comments/1t0qbbs/critical_alert_20_unpatched_wordpress · Reddit Post
• https://twitter.com/infoflowcloud/status/2047362128558821502 · Twitter Post
• https://plugins.trac.wordpress.org/browser/posts-map/tags/0.1.3/posts-map.php#L78 · Note
• https://plugins.trac.wordpress.org/browser/posts-map/tags/0.1.3/posts-map.php#L33 · Note
• https://wordpress.org/plugins/posts-map · Note
• https://twitter.com/CVEnew/status/2047359974158868611 · Twitter Post