# CVE-2026-107743: Mapster WP Maps stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-107743-the-mapster-wp-maps-plugin-for-wordpress-is-vulnerable-to-stored  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-107743 · Severity: high · CVSS 7.2 · Published 2026-10-29

The Mapster WP Maps plugin for WordPress, used to create interactive maps on websites, contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts. When a legitimate user views a page containing an injected map, the attacker's script executes in their browser, potentially stealing session cookies, redirecting them to phishing sites, or defacing content.

Technologies: [Mapster WP Maps](https://junglewise.ai/threats/technologies/mapster-wp-maps). Vendors: [Mapster](https://junglewise.ai/threats/vendors/mapster).

## Quick answers

**Is CVE-2026-107743 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107743 being exploited in the wild.

**How severe is CVE-2026-107743?** High severity, with a CVSS score of 7.2, published 29 October 2026.

**Which products and versions are affected?** Mapster WP Maps up to 2.0.5.

**Is there a fix for CVE-2026-107743?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-107743 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-107743?** Check whether you run Mapster WP Maps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from three issues: the /wp-json/mapster-wp-maps/save-mapmaker REST endpoint lacks proper authorization (permission_callback always returns true), the mapster_write_config_to_acf() function uses only sanitize_text_field() which strips HTML but preserves quotes, and the shortcode renderer concatenates the stored loading_background_color value into an inline style attribute without esc_attr() escaping. An unauthenticated attacker can POST malicious payloads via REST API, and the unescaped output in the single-quoted attribute allows breakout and script injection.

## Affected products

- Mapster WP Maps up to 2.0.5

## Timeline

- 2026-10-29: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.5/admin/api/class-mapster-wordpress-maps-api.php](https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.5/admin/api/class-mapster-wordpress-maps-api.php)
- [https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.5/admin/api/config-converter.php](https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.5/admin/api/config-converter.php)

## Related threats

- [Mapster WP Maps authorization bypass in REST API](https://junglewise.ai/threats/cve-2026-118638-the-mapster-wp-maps-wordpress-plugin-before-2-0-6-does-not)
- [Mapster WP Maps Cross-Site Scripting (XSS) vulnerability](https://junglewise.ai/threats/cve-2026-39720-unauthenticated-cross-site-scripting-xss-in-mapster-wp-maps-2-0-4)