CVE-2024-8990

Published
View on NVD ↗
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT

Description

The Geo Mashup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's geo_mashup_visible_posts_list shortcode in all versions up to, and including, 1.13.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

<p>This plugin lets you save location information with posts, pages, and other WordPress objects. These can then be presented on interactive maps in many ways.</p> <h4>Key Features</h4> <p>Geo Mashup, like WordPress, has a simple interface for basic features,<br /> templates for control of output, and APIs for endless customization options.</p> <p>Some popular features are:</p> <ul> <li>Use different map providers: <a href="https://developers.google.com/maps/documentation/javascript/reference" rel="nofollow ugc">Google Maps v3</a>, <a href="http://openlayers.org" rel="nofollow ugc">OpenLayers</a>, <a href="http://leafletjs.com" rel="nofollow ugc">Leaflet</a></li> <li> <p>Global maps can present your posts in many ways</p> <p>They can show just one category, custom taxonomy term, or custom post type, for example</p> <p>Clicking on a post marker shows a customizable summary of the post or page in an info window</p> </li> <li> <p>A Geo Search widget enables searching for content by distance from a search location</p> </li> <li>Marker clustering for Google maps</li> <li>Location can be saved for all post types (including pages) users, and comments</li> <li>Synchronize <a href="https://codex.wordpress.org/Geodata" rel="nofollow ugc">Geodata</a> with the Geo location mobile client and other plugins</li> <li>Support for both standard WordPress <a href="https://codex.wordpress.org/Shortcode_API" rel="nofollow ugc">shortcodes</a> and <a href="https://codex.wordpress.org/Template_Tags/How_to_Pass_Tag_Parameters" rel="nofollow ugc">template tags</a> to add maps to your site.</li> <li>Reverse geocoding to fill in address information for locations</li> <li>GeoRSS automatically added to feeds</li> <li>Attach KML files to posts and pages</li> <li>Connect category markers with a colored line</li> </ul> <p>If you need features that are aren&#8217;t listed here, check <a href="https://github.com/cyberhobo/wordpress-geo-mashup/wiki/Getting-Started" rel="nofollow ugc">the documentation</a> and the <a href="https://github.com/cyberhobo/wordpress-geo-mashup/wiki/Tag-Reference" rel="nofollow ugc">tag reference</a>.</p> <h4>Translations</h4> <ul> <li>Belarussian by <a href="https://hrank.com" rel="nofollow ugc">hrank</a> added in version 1.11.0</li> <li>Ukranian by <a href="http://everycloudtech.com/" rel="nofollow ugc">Ivanka of Everycloudtech</a> updated in version 1.8.6</li> <li>Dutch by <a href="http://delicatesther.nl/" rel="nofollow ugc">delicatesther</a> updated in version 1.8.5</li> <li>German by <a href="http://internet-dienste.biz/" rel="nofollow ugc">Thomas Morvay</a> added in version 1.5.4</li> <li>Slovak by B. Radenovich of <a href="http://webhostingw.com" rel="nofollow ugc">Web Hosting Watch</a> updated in version 1.5.4</li> <li>Romanian by <a href="http://www.fitnesstimisoara.ro/" rel="nofollow ugc">Florin Dumitru</a> added in version 1.5</li> <li>Irish by <a href="http://www.theseoink.com" rel="nofollow ugc">Vikas Arora</a> added in version 1.4.11</li> <li>Russian by <a href="http://tohapro.com" rel="nofollow ugc">Tony</a> added in version 1.4.10</li> <li>Hindi by <a href="http://outshinesolutions.com" rel="nofollow ugc">Outshine Solutions</a> added in version 1.4.9</li> <li>Polish by <a href="http://wbartoszycach.pl" rel="nofollow ugc">Kamil</a> added in version 1.4.7</li> <li>Portugese by <a href="http://flyingsouth.thehappytoadfish.com/" rel="nofollow ugc">Antonio Xeira</a> added in version 1.4.2</li> <li>Italian by <a href="http://thrifytuscany.com/" rel="nofollow ugc">Federico</a> added in version 1.3.10</li> <li>French updated in version 1.3.7</li> <li>Spanish by <a href="http://www.reven.org/blog/2010/03/15/traduccion-de-geo-mashup/" rel="nofollow ugc">Reven</a> added in version 1.3.3</li> <li>Swedish by <a href="http://www.joakimgreen.com/" rel="nofollow ugc">Joakim Green</a> added in version 1.3.3</li> </ul> <p><a href="https://github.com/cyberhobo/wordpress-geo-mashup/wiki/Translating" rel="nofollow ugc">Translators welcome</a>.</p> <h4>Mashup Ingredients</h4> <p>Geo Mashup combines WordPress, <a href="http://maps.google.com" rel="nofollow ugc">Google Maps</a>, <a href="http://openstreetmap.org" rel="nofollow ugc">OpenStreetMap</a>,<br /> and <a href="http://geonames.org" rel="nofollow ugc">GeoNames</a> to create a GeoCMS that puts you in control<br /> of all your content, including geographic data.</p> <p>Thanks for security reports to:</p> <ul> <li><a href="https://www.wordfence.com/threat-intel/vulnerabilities/researchers/leonid-semenenko" rel="nofollow ugc">Leonid Semenenko</a></li> <li><a href="https://vdp.patchstack.com/database/researchers/8ac0aa48-331b-4e0c-858b-07ea684d5139" rel="nofollow ugc">she11f</a></li> <li><a href="https://vdp.patchstack.com/database/researchers/e5bd3943-072d-4219-9144-64c2843a261b" rel="nofollow ugc">Baikuya</a></li> <li><a href="https://vdp.patchstack.com/database/researchers/9f3ffb0b-5ad7-4756-86d2-cd63a1d09469" rel="nofollow ugc">daroo</a></li> <li><a href="https://www.wordfence.com/threat-intel/vulnerabilities/researchers/n4kk0" rel="nofollow ugc">Naoya Takahashi (nakko)</a></li> <li><a href="https://vdp.patchstack.com/database/researchers/8f5691da-0aba-46ca-8be8-e3aad13cb3a2" rel="nofollow ugc">Muhammad Yudha &#8211; DJ</a></li> <li><a href="https://www.wordfence.com/threat-intel/vulnerabilities/researchers/nabil-irawan" rel="nofollow ugc">Nabil Irawan</a></li> <li><a href="https://patchstack.com/database/researcher/1ca635c5-9810-4bb5-a410-a651905ea23c" rel="nofollow ugc">Dimas Maulana</a></li> <li>Peter Thaleikis of Wordfence</li> <li><a href="https://patchstack.com/database/researcher/ada529e8-a3cf-495a-8dcb-3e5e460a4081" rel="nofollow ugc">LVT-tholv2k at patchstack</a></li> <li><a href="https://twitter.com/0ctac0der" rel="nofollow ugc">Abhinav Mishra</a></li> <li><a href="https://www.linkedin.com/in/alexchepovetsky" rel="nofollow ugc">Alex Chepovetsky</a></li> <li><a href="https://www.linkedin.com/in/maxim-lemberg-661a06149/" rel="nofollow ugc">Maxim Lemberg</a></li> </ul> <p>You can report security bugs through the Patchstack Vulnerability Disclosure Program.<br /> The Patchstack team help validate, triage and handle any security vulnerabilities.<br /> <a href="https://patchstack.com/database/vdp/geo-mashup" rel="nofollow ugc">Report a security vulnerability.</a></p>
WordPress Plugin DirectoryWordPress Plugin Directory
251K