{"id":"CVE-2021-24383","aliases":["EUVD-2021-11295","GHSA-hgx6-w8x6-xmxw"],"status":"published","title":"WP Google Maps \u003c 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)","description":"The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.02467,"percentile":0.84718,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2021-06-21T19:18:26Z","modified":"2026-06-17T03:39:56Z","exploits":[{"source":"exploitdb","id":"EDB-50051","title":"WordPress Plugin WP Google Maps 8.1.11 - Stored Cross-Site Scripting (XSS)","type":"webapps","platform":"php","date":"2021-06-23","url":"https://www.exploit-db.com/exploits/50051"}],"products":[{"vendor":"codecabin","product":"wp_go_maps"},{"vendor":"wp go maps (formerly wp google maps)","product":"wp google maps"},{"vendor":"wp google maps","product":"wp google maps"}],"references":[{"url":"https://wpscan.com/vulnerability/1270588c-53fe-447e-b83c-1b877dc7a954","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/163261/WordPress-WP-Google-Maps-8.1.11-Cross-Site-Scripting.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24383"},{"url":"https://github.com/advisories/GHSA-hgx6-w8x6-xmxw"}],"sources":{"cve":[{"id":"CVE-2021-24383","title":"WP Google Maps \u003c 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)","description":"The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue","status":"published","published":"2021-06-21T19:18:26Z","modified":"2024-08-03T19:28:23.794Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:05.000797Z"}],"euvd":[{"id":"EUVD-2021-11295","description":"The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue","status":"published","published":"2021-06-21T19:18:26Z","modified":"2024-08-03T19:28:23Z","updated_at":"2026-11-03T03:24:57.947294Z"}],"ghsa":[{"id":"GHSA-hgx6-w8x6-xmxw","title":"The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map...","description":"The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue","status":"published","published":"2022-05-24T19:05:47Z","modified":"2023-05-24T03:30:25Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:54:36.087743Z"}],"nvd":[{"id":"CVE-2021-24383","description":"The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue","status":"published","published":"2021-06-21T20:15:09.33Z","modified":"2026-06-17T03:39:56.19Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:54.892562Z"}]}}