Junglewise Threat Intelligence

CVE-2026-8907: WP-Ultimate-Map CSRF and Stored XSS in process_init

CVE-2026-8907 · Severity: medium · CVSS 6.1 · Published 2026-06-09

Executive brief

The WP-Ultimate-Map plugin for WordPress, which is used to display interactive maps on websites, contains a security flaw that allows attackers to change map settings without authorization. By tricking a site administrator into clicking a malicious link, an attacker can modify map coordinates or zoom levels and potentially inject malicious scripts into the website. This could lead to the website being used to spread malware or steal information from other site visitors.

Technical details

The WP-Ultimate-Map plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation on the process_init() function hooked to admin_init. This function updates plugin settings via update_option() based only on the presence of a 'save-setting' POST parameter. Furthermore, the plugin fails to sanitize these inputs, specifically the 'zoom-level' parameter, before storing them. Because these values are later echoed into HTML attributes and inline JavaScript without proper escaping, an attacker can achieve Stored Cross-Site Scripting (XSS). Exploitation requires an unauthenticated attacker to trick a logged-in administrator into submitting a forged request, typically via social engineering.

Affected products

  • WP-Ultimate-Map WP-Ultimate-Map up to, and including, 1.1

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory

References