Junglewise Threat Intelligence

CVE-2026-7464: WP Google Maps Integration reflected XSS in page parameter

CVE-2026-7464 · Severity: medium · CVSS 6.1 · Published 2026-05-12

Executive brief

The WP Google Maps Integration plugin for WordPress, which allows site owners to embed custom maps, contains a security flaw that could allow attackers to run malicious scripts in a user's browser. By tricking a site administrator into clicking a specially crafted link, an attacker could potentially hijack their session or perform unauthorized actions on the website. This risk affects all versions of the plugin up to and including 1.2.

Technical details

The WP Google Maps Integration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'page' parameter in versions up to and including 1.2. The vulnerability stems from insufficient input sanitization and output escaping within several administrative display files, including category-table-display.php and map-table-display.php. An unauthenticated remote attacker can exploit this by crafting a malicious URL and tricking a privileged user, such as an administrator, into clicking it. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can lead to session theft or unauthorized administrative actions.

Affected products

  • WP Google Maps Integration WP Google Maps Integration Up to, and including, 1.2

Timeline

  • 2026-05-12: disclosed: Initial disclosure and NVD publication

References