CVE-2021-24383
WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)
Vexday Risk Score
23Low
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Proof of concept
Public proof of concept exists, but not yet automated.
CVSS —EPSS 2.3%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
21 Jun 2021Published on NVD
23 Jun 2021Public PoC
Weaponization speed
1 daysto first PoC
Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.
Recommendation: Plan a near-term fix — a public PoC already exists.
The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
Affected products
WP Google Maps · WP Google Mapspublic PoCs found — 2
cve_referencepacketstormsecurity.com/files/163261/WordPress-WP-Google-Maps-8.1.11-Cross-Site-Scripting.htmlunverifiedexploitdbwww.exploit-db.com/exploits/50051unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.