CVE-2026-13335: WordPress Post Map Plugin XSS Vulnerability

CVE-2026-13335 Overview

CVE-2026-13335 is a stored Cross-Site Scripting (XSS) vulnerability in the CodePeople Post Map for Google Maps plugin for WordPress. The flaw affects all versions up to and including 1.2.6. It stems from insufficient input sanitization and output escaping on the cpm_point post meta field. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes when any visitor loads the affected page. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated Contributors can persist malicious scripts that execute in the browsers of site administrators and visitors, enabling session theft, privilege escalation, and site defacement.

Affected Products

CodePeople Post Map for Google Maps plugin for WordPress
All versions up to and including 1.2.6
WordPress installations exposing Contributor-level or higher accounts

Discovery Timeline

2026-06-27 - CVE CVE-2026-13335 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13335

Vulnerability Analysis

The CodePeople Post Map plugin stores map point data in the cpm_point post meta field. According to the referenced source code in include/functions.php at lines 132, 163, 710, 712, 713, and 881, the plugin reads this metadata and renders it into the page output without adequate sanitization or escaping. Because the payload persists in the WordPress database, every visitor to an affected post or page triggers the injected script. The scope change reflected in the CVSS vector indicates the injected code can affect resources beyond the vulnerable component, such as the WordPress admin session context.

Root Cause

The plugin trusts values pulled from the cpm_point post meta and inserts them into HTML output without calling WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). Contributor-level authors can supply the meta value through the post editor. The stored value is later reflected verbatim in the map rendering logic, allowing arbitrary HTML and JavaScript to break out of the intended context.

Attack Vector

An authenticated attacker with at least Contributor privileges creates or edits a post that uses the plugin's map functionality. The attacker supplies a malicious payload in the cpm_point meta value containing script tags or JavaScript event handlers. When an administrator previews the post, or when the post is published and viewed by any user, the injected code executes in the victim's browser under the site's origin. This enables cookie theft, forced administrative actions via CSRF, and injection of secondary payloads.

No verified proof-of-concept code has been published. Refer to the Wordfence Vulnerability Report and the WordPress plugin source for technical context.

Detection Methods for CVE-2026-13335

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or DOM event handlers stored in wp_postmeta rows where meta_key = 'cpm_point'.
Outbound requests from administrator browsers to unknown domains shortly after loading posts that use the plugin.
New or modified WordPress administrator accounts created after Contributor-authored posts were previewed.

Detection Strategies

Query the WordPress database for cpm_point meta values containing HTML tags, <script, onerror=, onload=, or encoded variants such as %3Cscript.
Review web server logs for POST requests to /wp-admin/post.php from Contributor accounts, correlated with subsequent script execution on published pages.
Inspect rendered HTML of pages using the plugin for unescaped user-controlled content within map point markup.

Monitoring Recommendations

Alert on privilege changes, plugin installations, and administrator account creation in WordPress audit logs.
Monitor Content Security Policy (CSP) violation reports for unexpected inline script execution on pages hosting the plugin.
Track browser telemetry from administrative sessions for anomalous cross-origin requests originating from the WordPress front-end.

How to Mitigate CVE-2026-13335

Immediate Actions Required

Update the CodePeople Post Map for Google Maps plugin to a version newer than 1.2.6 once the vendor releases a patched build.
Audit existing cpm_point post meta entries and remove any values containing HTML or script content.
Restrict Contributor-level and higher accounts to trusted users, and reset credentials for any account suspected of exploitation.

Patch Information

The vendor has committed changes referenced in the WordPress Changeset Update. Site administrators should upgrade to the fixed release published after version 1.2.6. Consult the Wordfence Vulnerability Report for the current fixed version.

Workarounds

Deactivate and remove the CodePeople Post Map for Google Maps plugin until a patched version is installed.
Deploy a web application firewall rule that blocks HTML and script characters in requests writing to the cpm_point meta field.
Enforce a strict Content Security Policy that disallows inline scripts on public-facing pages rendered by the plugin.
Downgrade Contributor accounts to Subscriber where publishing is not required.

bash

# Example WordPress CLI query to identify potentially malicious stored payloads
wp db query "SELECT post_id, meta_value FROM wp_postmeta \
  WHERE meta_key = 'cpm_point' \
  AND (meta_value LIKE '%<script%' \
    OR meta_value LIKE '%onerror=%' \
    OR meta_value LIKE '%javascript:%');"