CVE-2023-6524

CVE-2023-6524 describes a Stored Cross-Site Scripting (XSS) vulnerability in the MapPress Maps for WordPress plugin, affecting all versions up to and including 2.88.13. This flaw stems from insufficient input sanitization and output escaping of the map title parameter. Authenticated attackers with contributor-level access or higher can inject malicious web scripts that execute when a user views an affected page. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low attack complexity, requiring user interaction, and resulting in low impact to confidentiality and integrity. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score is 21/100. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered minimal community discussion and media coverage, which is typical for a significant percentage of CVEs.