{"id":"CVE-2020-36853","aliases":["EUVD-2020-30803","GHSA-gx97-gg4r-qw22"],"status":"published","title":"10WebMapBuilder \u003c= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change","description":"The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due to insufficient input sanitization and output escaping and a lack of capability checks. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0038,"percentile":0.32475,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-10-18T03:33:23Z","modified":"2026-06-17T03:16:20Z","products":[{"vendor":"10web","product":"10web map builder for google maps"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c1c24cc-9388-4d91-8dc6-c67d3420cc94?source=cve"},{"url":"https://www.wordfence.com/blog/2020/02/site-takeover-campaign-exploits-multiple-zero-day-vulnerabilities/"},{"url":"https://plugins.trac.wordpress.org/changeset/2251882/wd-google-maps"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36853"},{"url":"https://www.wordfence.com/blog/2020/02/site-takeover-campaign-exploits-multiple-zero-day-vulnerabilities"},{"url":"https://github.com/advisories/GHSA-gx97-gg4r-qw22"}],"sources":{"cve":[{"id":"CVE-2020-36853","title":"10WebMapBuilder \u003c= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change","description":"The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due to insufficient input sanitization and output escaping and a lack of capability checks. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2025-10-18T03:33:23.819Z","modified":"2026-04-08T17:02:37.382Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:55.128961Z"}],"euvd":[{"id":"EUVD-2020-30803","description":"The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due to insufficient input sanitization and output escaping and a lack of capability checks. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2025-10-18T03:33:23Z","modified":"2026-04-08T17:02:37Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T19:24:52.430714Z"}],"ghsa":[{"id":"GHSA-gx97-gg4r-qw22","title":"The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin...","description":"The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due to insufficient input sanitization and output escaping and a lack of capability checks. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2025-10-18T06:30:25Z","modified":"2025-10-18T06:30:31Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:04:01.823376Z"}],"nvd":[{"id":"CVE-2020-36853","description":"The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due to insufficient input sanitization and output escaping and a lack of capability checks. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2025-10-18T04:16:02.377Z","modified":"2026-06-17T03:16:20.127Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:48.591569Z"}]}}