Is CVE-2026-107743 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107743 being exploited in the wild.

How severe is CVE-2026-107743?

High severity, with a CVSS score of 7.2, published 29 October 2026.

Is there a fix for CVE-2026-107743?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-107743 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107743?

Check whether you run Mapster WP Maps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107743: Mapster WP Maps stored cross-site scripting

CVE-2026-107743 · Severity: high · CVSS 7.2 · Published 2026-10-29

The Mapster WP Maps plugin for WordPress, used to create interactive maps on websites, contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts. When a legitimate user views a page containing an injected map, the attacker's script executes in their browser, potentially stealing session cookies, redirecting them to phishing sites, or defacing content.

Technologies: Mapster WP Maps. Vendors: Mapster.

Quick answers

Is CVE-2026-107743 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107743 being exploited in the wild.
How severe is CVE-2026-107743?: High severity, with a CVSS score of 7.2, published 29 October 2026.
Which products and versions are affected?: Mapster WP Maps up to 2.0.5.
Is there a fix for CVE-2026-107743?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107743 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107743?: Check whether you run Mapster WP Maps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from three issues: the /wp-json/mapster-wp-maps/save-mapmaker REST endpoint lacks proper authorization (permission_callback always returns true), the mapster_write_config_to_acf() function uses only sanitize_text_field() which strips HTML but preserves quotes, and the shortcode renderer concatenates the stored loading_background_color value into an inline style attribute without esc_attr() escaping. An unauthenticated attacker can POST malicious payloads via REST API, and the unescaped output in the single-quoted attribute allows breakout and script injection.

Affected products

Mapster WP Maps up to 2.0.5

Timeline

2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.