CVE-2022-0208
MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scripting
Vexday Risk Score
18Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 2.0%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
14 Feb 2022Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting
Affected products
Unknown · MapPress Maps for WordPressWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →