{"id":"CVE-2026-125824","kind":"vulnerability","aliases":["CVE-2026-125824"],"related":[],"title":"WP Go Maps WordPress plugin: stored XSS through versions 10.1.10","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10.","summary":"The WP Go Maps (wp-google-maps) WordPress plugin fails to neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can store malicious content in the plugin can run scripts in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-go-maps"],"not_affected_if":["plugin-not-installed","version-above-10.1.10"],"how_to_check":"- Check the installed WP Go Maps plugin version in the WordPress admin Plugins screen, or with `wp plugin get wp-google-maps --field=version`\n- Compare the installed version against the affected range through `10.1.10`","fix":null,"status":"open","published_at":"2026-11-13T15:17:41+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","triaged_at":"2026-11-13T15:48:48+00:00","updated_at":"2026-11-13T15:48:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:48:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Go Maps WordPress plugin: stored XSS through versions 10.1.10","impact":"medium","summary":"The WP Go Maps (wp-google-maps) WordPress plugin fails to neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can store malicious content in the plugin can run scripts in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-go-maps","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker scripts run in visitors' browsers, stealing sessions","analyst_note":"Confirm the fixed version and the required privilege level from the NVD entry or the plugin's changelog; the sources give only the affected range.","how_to_check":"- Check the installed WP Go Maps plugin version in the WordPress admin Plugins screen, or with `wp plugin get wp-google-maps --field=version`\n- Compare the installed version against the affected range through `10.1.10`\n- unknown for a fixed version","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-10.1.10"],"who_is_affected":"Sites running the WP Go Maps (wp-google-maps) WordPress plugin at version 10.1.10 or earlier are exposed. The risk depends on who can enter map data that is later shown to visitors; sites where only trusted administrators edit maps carry less exposure. unknown for whether a newer version is patched.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4555,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125824':13A,16A '-2026':12A,15A '10.1.10':10A,102C 'affect':95C 'allow':44B,91C 'attack':51B 'browser':66B 'content':56B 'cross':47B,76C 'cross-sit':46B,75C 'cve':11A,14A 'fail':36B 'generat':41B,74C 'go':2A,24B,28B,82C,85C,97C 'googl':32B,89C 'host':20B 'improp':67C 'input':39B,70C 'issu':94C 'malici':55B 'map':3A,25B,29B,33B,83C,86C,90C,98C 'n/a':100C 'neutral':38B,68C 'packag':17B 'page':43B,73C 'plugin':5A,35B,59B 'run':61B 'script':49B,62B,78C 'self':19B 'self-host':18B 'site':48B,77C 'store':6A,45B,54B,92C 'version':9A 'visitor':65B 'vulner':79C 'web':42B,72C 'wordpress':4A,21B,34B 'wp':1A,23B,27B,31B,81C,84C,88C,96C 'wp-go-map':22B 'wp-google-map':30B,87C 'xss':7A 'xss.this':93C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Go Maps (wp-google-maps) WordPress plugin at version 10.1.10 or earlier are exposed. The risk depends on who can enter map data that is later shown to visitors; sites where only trusted administrators edit maps carry less exposure. unknown for whether a newer version is patched.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress","wpgomaps"],"campaign_type":null,"search_a":"'-125824':13A,16A '-2026':12A,15A '10.1.10':10A 'cve':11A,14A 'go':2A 'map':3A 'plugin':5A 'store':6A 'version':9A 'wordpress':4A 'wp':1A 'xss':7A","search_b":"'allow':44B 'attack':51B 'browser':66B 'content':56B 'cross':47B 'cross-sit':46B 'fail':36B 'generat':41B 'go':24B,28B 'googl':32B 'host':20B 'input':39B 'malici':55B 'map':25B,29B,33B 'neutral':38B 'packag':17B 'page':43B 'plugin':35B,59B 'run':61B 'script':49B,62B 'self':19B 'self-host':18B 'site':48B 'store':45B,54B 'visitor':65B 'web':42B 'wordpress':21B,34B 'wp':23B,27B,31B 'wp-go-map':22B 'wp-google-map':30B","search_c":"'10.1.10':102C 'affect':95C 'allow':91C 'cross':76C 'cross-sit':75C 'generat':74C 'go':82C,85C,97C 'googl':89C 'improp':67C 'input':70C 'issu':94C 'map':83C,86C,90C,98C 'n/a':100C 'neutral':68C 'page':73C 'script':78C 'site':77C 'store':92C 'vulner':79C 'web':72C 'wp':81C,84C,88C,96C 'wp-google-map':87C 'xss.this':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125824","severity":null,"published_at":"2026-11-13T15:17:41+00:00","modified_at":"2026-11-13T15:17:41+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","fetched_at":"2026-11-13T15:46:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}