CVE-2026-4268: WP Go Maps Plugin Stored XSS Vulnerability

CVE-2026-4268 Overview

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the wpgmza_custom_js parameter in all versions up to, and including, 10.0.05. This vulnerability exists due to insufficient input sanitization and output escaping, combined with a missing capability check in the admin_post_wpgmza_save_settings hook anonymous function. This allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.

Critical Impact

Attackers with low-privilege WordPress accounts can inject persistent malicious scripts that execute in the browsers of all site visitors and administrators, potentially leading to session hijacking, credential theft, and site compromise.

Affected Products

• WP Go Maps (WP Google Maps) plugin for WordPress versions up to and including 10.0.05
• WordPress installations using vulnerable WP Go Maps plugin versions

Discovery Timeline

• 2026-03-18 - CVE-2026-4268 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-4268

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability resides in the settings page functionality of the WP Go Maps plugin, specifically within the class.settings-page.php file.

The core issue stems from two compounding security failures: first, the plugin fails to properly sanitize user-supplied input in the wpgmza_custom_js parameter before storing it in the database. Second, there is a missing capability check in the admin_post_wpgmza_save_settings hook, which means the function does not verify that the authenticated user has administrative privileges before allowing settings modifications.

This combination allows users with minimal authentication (Subscriber-level or above) to submit malicious JavaScript code through the custom JS parameter. The injected script is then stored persistently and rendered without proper output escaping, causing it to execute in the browser context of any user who visits a page containing the compromised maps component.

Root Cause

The vulnerability originates from the inadequate implementation of input validation and authorization controls in the plugin's settings handling mechanism. The admin_post_wpgmza_save_settings hook anonymous function accepts and stores the wpgmza_custom_js parameter value without:

1. Verifying the submitting user has appropriate administrative capabilities
2. Sanitizing the input to remove or encode potentially dangerous JavaScript code
3. Properly escaping the output when the stored value is rendered on frontend pages

This triple failure creates an exploitable attack surface where low-privilege authenticated users can inject and persist malicious scripts.

Attack Vector

The attack requires network access and low-privilege authentication (Subscriber account or higher). An attacker would authenticate to the WordPress site with a Subscriber account, then craft a malicious request to the settings save endpoint containing JavaScript payload in the wpgmza_custom_js parameter.

The vulnerability mechanism involves submitting crafted input to the settings save hook without proper authorization validation. An attacker can inject arbitrary JavaScript code that will be stored and subsequently executed when any user views a page containing the WP Go Maps component. For detailed technical analysis, refer to the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-4268

Indicators of Compromise

• Unexpected JavaScript code present in the WP Go Maps plugin settings, particularly in the custom JS field
• WordPress database entries in the options table containing suspicious script tags or JavaScript code associated with the plugin
• Unauthorized modifications to plugin settings by non-administrative users in the WordPress audit logs
• Browser security warnings or anomalous script execution on pages containing maps components

Detection Strategies

• Review WordPress activity logs for settings changes made by Subscriber-level or low-privilege accounts
• Inspect the wpgmza_custom_js database value for unauthorized or suspicious JavaScript code
• Monitor HTTP POST requests to the admin_post_wpgmza_save_settings endpoint from non-admin users
• Implement Content Security Policy (CSP) headers to detect and block inline script execution anomalies

Monitoring Recommendations

• Deploy Web Application Firewall (WAF) rules to detect XSS payload patterns in plugin settings parameters
• Enable WordPress audit logging to track all plugin settings modifications with user attribution
• Configure alerts for settings changes made by non-administrative WordPress users
• Implement browser-based XSS detection mechanisms through CSP violation reporting

How to Mitigate CVE-2026-4268

Immediate Actions Required

• Update WP Go Maps plugin to a version newer than 10.0.05 that addresses this vulnerability
• Audit current plugin settings for any unauthorized or suspicious JavaScript code in the custom JS field
• Review WordPress user accounts and remove unnecessary Subscriber-level access
• Implement additional authorization checks at the server or WAF level for plugin settings endpoints

Patch Information

The vulnerability affects WP Go Maps versions up to and including 10.0.05. Site administrators should update to the latest available version of the plugin that includes fixes for proper input sanitization, output escaping, and capability checks in the settings save functionality. Consult the Wordfence Vulnerability Report for the latest remediation guidance.

Workarounds

• Restrict Subscriber-level account registrations until the plugin is updated
• Implement server-level access controls to block unauthenticated requests to admin-post.php with the wpgmza_save_settings action
• Use a WordPress security plugin to add additional capability checks for plugin settings modifications
• Deploy Content Security Policy headers to mitigate the impact of any injected scripts

# Configuration example - Add to .htaccess to restrict settings endpoint access
<Files "admin-post.php">
    <If "%{QUERY_STRING} =~ /action=wpgmza_save_settings/">
        Require all denied
    </If>
</Files>