CVE-2024-13220: Google Map Professional XSS Vulnerability

CVE-2024-13220 Overview

CVE-2024-13220 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WordPress Google Map Professional (Map In Your Language) plugin by Pragmasoftwares. The plugin, through version 1.0, fails to sanitize and escape a parameter before returning it in the rendered page. Attackers can craft a malicious URL that executes arbitrary JavaScript in the victim's browser when clicked. The attack targets high-privilege users such as administrators, potentially leading to session hijacking or administrative account takeover.

Critical Impact
An attacker who tricks an authenticated WordPress administrator into visiting a crafted link can execute arbitrary JavaScript in the admin's browser context, enabling account takeover and site compromise.

Affected Products

Pragmasoftwares Google Map Professional (Map In Your Language)
All WordPress plugin versions through 1.0
WordPress sites with the plugin installed and active

Discovery Timeline

2025-01-31 - CVE-2024-13220 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13220

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw classified under [CWE-79]. The Google Map Professional plugin accepts a user-supplied parameter through an HTTP request and echoes it directly into the HTML response. Because the plugin performs no sanitization or output escaping, an attacker can inject arbitrary JavaScript payloads through the vulnerable parameter.

Exploitation requires user interaction. The victim must click a crafted link or visit an attacker-controlled page that triggers the request. When executed in the context of a logged-in administrator, the injected script inherits the admin's session privileges. Attackers can steal authentication cookies, submit privileged actions through the WordPress REST API, create new administrator accounts, or plant persistent backdoors.

The scope-changed nature of the flaw reflects the ability of injected JavaScript to affect resources beyond the vulnerable component, including other browser contexts and site data accessible to the admin session.

Root Cause

The root cause is missing input sanitization and output escaping in the plugin's request handling code. The vulnerable parameter is written back into the page without applying WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses(). Any string received from the client is trusted verbatim and rendered as HTML.

Attack Vector

The attack is delivered over the network and requires no authentication on the attacker's part. The attacker crafts a URL containing a JavaScript payload in the vulnerable parameter and delivers it to a target administrator through phishing, social engineering, or a malicious website. When the admin clicks the link, the payload reflects into the page and executes in the browser. Technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2024-13220

Indicators of Compromise

HTTP request logs containing URL parameters with <script>, javascript:, onerror=, or encoded variants targeting plugin endpoints
Unexpected creation of new WordPress administrator accounts or modification of existing user roles
Outbound requests from admin browser sessions to unfamiliar domains shortly after clicking external links
Presence of unfamiliar JavaScript files or modifications to plugin and theme files in wp-content/

Detection Strategies

Inspect web server access logs for request parameters containing HTML tags, encoded scripts, or event handler attributes directed at Google Map Professional plugin URLs
Deploy a Web Application Firewall (WAF) rule set that identifies reflected XSS patterns in query strings and POST bodies
Monitor WordPress audit logs for administrative actions originating from unusual referrers or user agents

Monitoring Recommendations

Enable WordPress security plugin logging to capture user role changes, plugin installations, and file modifications
Alert on any outbound HTTP requests from admin sessions to domains not on an approved allowlist
Correlate admin login events with subsequent privileged actions to identify session anomalies

How to Mitigate CVE-2024-13220

Immediate Actions Required

Deactivate and remove the WordPress Google Map Professional (Map In Your Language) plugin until a patched version is available
Instruct administrators to avoid clicking untrusted links and to log out of WordPress sessions when not actively administering the site
Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected
Review WordPress user accounts and remove any unrecognized administrator accounts

Patch Information

At the time of NVD publication, no vendor patch is referenced for versions through 1.0. Monitor the WPScan advisory and the Pragmasoftwares WordPress plugin listing for updates. Apply any released version above 1.0 that addresses the sanitization defect once available.

Workarounds

Uninstall the plugin and replace it with a maintained mapping plugin that applies proper input sanitization
Configure a Web Application Firewall to block requests containing script tags or event handler payloads targeting the plugin's endpoints
Enforce Content Security Policy (CSP) headers that restrict inline script execution in the WordPress admin interface
Require multi-factor authentication for all administrator accounts to reduce the impact of session compromise

bash

# Example WAF rule (ModSecurity) to block reflected XSS patterns
SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1002401,phase:2,deny,status:403,\
    msg:'Potential XSS payload targeting WordPress plugin (CVE-2024-13220)'"