{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mapster-wp-maps--2.0.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mapster:wp_maps:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-107743"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mapster WP Maps (\u003c= 2.0.5)"],"_cs_severities":["high"],"_cs_tags":["xss","web-application","wordpress","cve-2026-107743"],"_cs_type":"advisory","_cs_vendors":["Mapster"],"content_html":"\u003cp\u003eThe Mapster WP Maps plugin for WordPress (versions 2.0.5 and below) is vulnerable to Stored Cross-Site Scripting (XSS). An unauthenticated attacker can reach the \u003ccode\u003e/wp-json/mapster-wp-maps/save-mapmaker\u003c/code\u003e REST endpoint, which lacks capability checks or nonce validation. The \u003ccode\u003emapster_write_config_to_acf()\u003c/code\u003e helper improperly sanitizes inputs, leaving quote characters intact. Subsequently, the \u003ccode\u003emapster_wp_map\u003c/code\u003e shortcode renderer concatenates the \u003ccode\u003eloading_background_color\u003c/code\u003e value directly into an inline style attribute without output escaping, leading to arbitrary JavaScript execution in the browser of any user viewing an affected page.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim user's browser, potentially leading to unauthorized actions, session hijacking, or defacement of WordPress pages where the plugin is embedded.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Mapster WP Maps plugin to the latest version as provided by the vendor.\u003c/li\u003e\n\u003cli\u003eAudit WordPress site logs for unauthorized POST requests to the \u003ccode\u003e/wp-json/mapster-wp-maps/save-mapmaker\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eImplement Web Application Firewall (WAF) rules to restrict access to the \u003ccode\u003e/wp-json/mapster-wp-maps/\u003c/code\u003e REST route if the functionality is not actively required for public-facing features.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T11:13:50Z","date_published":"2026-10-29T11:13:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mapster-wp-maps-xss/","summary":"The Mapster WP Maps plugin for WordPress up to version 2.0.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into map configurations via the REST API.","title":"Mapster WP Maps: Stored Cross-Site Scripting (CVE-2026-107743)","url":"https://feed.craftedsignal.io/briefs/2026-10-mapster-wp-maps-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Mapster WP Maps (\u003c= 2.0.5)","version":"https://jsonfeed.org/version/1.1"}