CVE-2021-36871 - OpenCVE

Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1.11). Vulnerable parameters: &wpgmaps_marker_category_name, Value > &attributes[], Name > &attributes[], &icons[], &names[], &description, &link, &title.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:S/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Codecabin	Wp Go Maps

Configuration 1 [-]

cpe:2.3:a:codecabin:wp_go_maps:*:*:*:*:pro:wordpress:*:*

References

Link	Resource
https://patchstack.com/database/vulnerability/wp-google-maps-pro/wordpress-wp-google-maps-pro-premium-plugin-8-1-11-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities	Third Party Advisory
https://www.wpgmaps.com/documentation/pro-changelog/	Release Notes Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: Patchstack

Published: 2021-09-08T00:00:00

Updated: 2021-09-09T11:19:51

Reserved: 2021-07-19T00:00:00

Link: CVE-2021-36871

JSON object: View

NVD Information

Status : Analyzed

Published: 2021-09-09T12:15:09.510

Modified: 2023-05-23T20:30:59.777

Link: CVE-2021-36871

JSON object: View

Redhat Information

No data.

CWE

CWE-79

{"containers": {"cna": {"affected": [{"product": "WP Google Maps Pro", "vendor": "Code Cabin Inc", "versions": [{"lessThanOrEqual": "8.1.11", "status": "affected", "version": "8.1.11", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Original researcher - Vlad Visse (Patchstack Red Team)"}], "datePublic": "2021-09-08T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1.11). Vulnerable parameters: &wpgmaps_marker_category_name, Value > &attributes[], Name > &attributes[], &icons[], &names[], &description, &link, &title."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-09-09T11:19:51", "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.wpgmaps.com/documentation/pro-changelog/"}, {"tags": ["x_refsource_MISC"], "url": "https://patchstack.com/database/vulnerability/wp-google-maps-pro/wordpress-wp-google-maps-pro-premium-plugin-8-1-11-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities"}], "solutions": [{"lang": "en", "value": "Update to the 8.1.12 version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress WP Google Maps Pro premium plugin <= 8.1.11 - Multiple Authenticated Persistent XSS vulnerabilities", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "audit@patchstack.com", "DATE_PUBLIC": "2021-09-08T11:52:00.000Z", "ID": "CVE-2021-36871", "STATE": "PUBLIC", "TITLE": "WordPress WP Google Maps Pro premium plugin <= 8.1.11 - Multiple Authenticated Persistent XSS vulnerabilities"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "WP Google Maps Pro", "version": {"version_data": [{"version_affected": "<=", "version_name": "8.1.11", "version_value": "8.1.11"}]}}]}, "vendor_name": "Code Cabin Inc"}]}}, "credit": [{"lang": "eng", "value": "Original researcher - Vlad Visse (Patchstack Red Team)"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1.11). Vulnerable parameters: &wpgmaps_marker_category_name, Value > &attributes[], Name > &attributes[], &icons[], &names[], &description, &link, &title."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://www.wpgmaps.com/documentation/pro-changelog/", "refsource": "CONFIRM", "url": "https://www.wpgmaps.com/documentation/pro-changelog/"}, {"name": "https://patchstack.com/database/vulnerability/wp-google-maps-pro/wordpress-wp-google-maps-pro-premium-plugin-8-1-11-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities", "refsource": "MISC", "url": "https://patchstack.com/database/vulnerability/wp-google-maps-pro/wordpress-wp-google-maps-pro-premium-plugin-8-1-11-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities"}]}, "solution": [{"lang": "en", "value": "Update to the 8.1.12 version."}], "source": {"discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "assignerShortName": "Patchstack", "cveId": "CVE-2021-36871", "datePublished": "2021-09-08T00:00:00", "dateReserved": "2021-07-19T00:00:00", "dateUpdated": "2021-09-09T11:19:51", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:codecabin:wp_go_maps:*:*:*:*:pro:wordpress:*:*", "matchCriteriaId": "54F46FAD-90B7-4C5A-B263-E74F86EDA494", "versionEndIncluding": "8.1.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1.11). Vulnerable parameters: &wpgmaps_marker_category_name, Value > &attributes[], Name > &attributes[], &icons[], &names[], &description, &link, &title."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de tipo Cross-Site Scripting (XSS) Persistentes y Autenticadas en el plugin WP Google Maps Pro premium de WordPress (versiones anteriores a 8.1.11, incluy\u00e9ndola). Par\u00e1metros vulnerables: &wpgmaps_marker_category_name, Value ) &attributes[], Name ) &attributes[], &icons[], &names[], &description, &link, &title"}], "id": "CVE-2021-36871", "lastModified": "2023-05-23T20:30:59.777", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2021-09-09T12:15:09.510", "references": [{"source": "audit@patchstack.com", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/wp-google-maps-pro/wordpress-wp-google-maps-pro-premium-plugin-8-1-11-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities"}, {"source": "audit@patchstack.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.wpgmaps.com/documentation/pro-changelog/"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Secondary"}]}