Mapster WP Maps: Unauthenticated stored Cross-Site Scripting
Summary
The Mapster WP Maps WordPress plugin up to and including version 2.0.5 contains a stored Cross-Site Scripting vulnerability (CWE-79). A map configuration REST endpoint does not check permissions, and the background color value is output without proper escaping in an inline style attribute. An unauthenticated attacker can therefore store script code that runs in the browser of visitors who open an affected page, including logged-in administrators.
Affected
- Mapster WP Maps plugin for WordPress, versions 0 to and including 2.0.5
Fixed in
- Version 2.0.6 (vendor changelog lists a security fix on the Mapmaker endpoint; the CVE is not named there)
Workaround
- No vendor-documented workaround known.
- If an update is not possible, deactivate the plugin or remove the map shortcode from pages (own suggestion, not a vendor mitigation).
Exploitation
- Not known to be exploited.
- No public proof of concept found.
- Not listed in CISA KEV.
- Scores differ: Wordfence (CNA) 7.2 High, VulDB 4.3 Medium. EPSS 0.4 %.
Our recommendation
- Check whether Mapster WP Maps is installed and which version is active.
- Update to version 2.0.6 or later and confirm the version in the WordPress admin.
- If the plugin cannot be updated, deactivate it.
- Scan map pages for unexpected script and review recent changes to map settings.
- Prioritise this for public WordPress sites using the plugin.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intel record www.wordfence.com
- Plugin file at 2.0.5 (public class) plugins.trac.wordpress.org
- Plugin file at 2.0.6 (public class) plugins.trac.wordpress.org
- VulDB advisory 428338 vuldb.com
- WPScan plugin page wpscan.com
- OffSeq Radar threat entry radar.offseq.com
- GitHub issue tracker entry github.com
- Related advisory CVE-2026-118638 (VulDB 429479) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 03:22.
Original description (NVD)
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permission_callback that unconditionally returns true (no capability check, no nonce), together with the mapster_write_config_to_acf() helper only sanitizing string config values with sanitize_text_field() — which strips HTML tags but leaves quote characters intact — and the mapster_wp_map shortcode renderer in mapster_wordpress_maps_shortcode_display() concatenating the stored loading_background_color value into a single-quoted inline style attribute without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD references (6)
- https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.5/admin/api/class-mapster-wordpress-maps-…
- https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.5/admin/api/config-converter.php#L523
- https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.5/admin/api/field-map.php#L304
- https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.5/public/class-mapster-wordpress-maps-pub…
- https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.6/public/class-mapster-wordpress-maps-pub…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/de1c951f-8b01-44cf-b192-412de9fae4fa?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.