Mapster WP Maps: Stored Cross-Site Scripting (CVE-2026-107743)

The Mapster WP Maps plugin for WordPress (versions 2.0.5 and below) is vulnerable to Stored Cross-Site Scripting (XSS). An unauthenticated attacker can reach the /wp-json/mapster-wp-maps/save-mapmaker REST endpoint, which lacks capability checks or nonce validation. The mapster_write_config_to_acf() helper improperly sanitizes inputs, leaving quote characters intact. Subsequently, the mapster_wp_map shortcode renderer concatenates the loading_background_color value directly into an inline style attribute without output escaping, leading to arbitrary JavaScript execution in the browser of any user viewing an affected page.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim user's browser, potentially leading to unauthorized actions, session hijacking, or defacement of WordPress pages where the plugin is embedded.

Recommendation

• Upgrade the Mapster WP Maps plugin to the latest version as provided by the vendor.
• Audit WordPress site logs for unauthorized POST requests to the /wp-json/mapster-wp-maps/save-mapmaker endpoint.
• Implement Web Application Firewall (WAF) rules to restrict access to the /wp-json/mapster-wp-maps/ REST route if the functionality is not actively required for public-facing features.