Ian Dunn · Report #160488
stored SELF xss on Basic Google Maps Placemarks Settings plugin
N/Astatus
4upvotes
27 Sept 2016disclosed
How it was found
Hi Ian,
I have to say, normally I don't report and vendors doesn't accept self xss vulnerabilities as valid, but I'm encouraged by #9375 So, I'm reporting this.
Placemark title field is NOT sanitizing the user input properly. I've updated wordpress to latest, and checked your plugin's versiyon from SVN also, it is latest, too. You can confirm in the attached PoC Screenshots. Thanks for giving opportunity to test your plugins! Keep up good work.
If you don't find this report useful for you, you can just close it as informative or whatever you like.
Regards