Skip to content
Sign in
7.2 High

CVE-2020-36853 The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in…

Description

The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due to insufficient input sanitization and output escaping and a lack of capability checks. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products and versions

Product Affected versions Fixed in
10Web Map Builder for Google Maps 1.0 earliest → < 1.0.64 1.0.64

Other CVEs of 10Web Map Builder for Google Maps

The 3 CVEs of 10Web Map Builder for Google Maps →
CVE-2023-45272 Missing Authorization vulnerability in 10Web 10Web Map Builder for Google Maps allows Exploiting Incorrectly… 5.4 Medium CVE-2024-31116 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web 10Web Map… 7.6 High
Track this CVE