CVE-2026-13335: Stored XSS in CodePeople Post Map Plugin (WordPress) – CVSS 6.4

Technical summary

CVE-2026-13335 is a Stored XSS vulnerability (CWE-79) in the CodePeople Post Map plugin stemming from insufficient input sanitization and output escaping of the 'cpm_point' post meta field. The vulnerability requires authentication at the Contributor level or above, allowing an attacker to craft malicious payloads in map point metadata. When pages containing the affected map are rendered, the unsanitized data is output directly to the page without proper HTML entity encoding, causing arbitrary JavaScript execution in the context of the website. The CVSS 3.1 score of 6.4 (MEDIUM) reflects the requirement for authenticated access combined with the potential for cross-site impact.

Business impact

This vulnerability poses a credential theft and website defacement risk. Attackers with Contributor access or higher can persistently inject JavaScript to steal session cookies, redirect users to malicious sites, harvest form data, or modify page content. For multi-author WordPress sites, this is particularly concerning if contributor accounts are shared, compromised, or belong to contractors with limited vetting. The stored nature means the attack affects all visitors until remediation, amplifying exposure. Compromised sites also risk search engine delisting if malicious content is detected.

Affected systems

The CodePeople Post Map for Google Maps plugin is vulnerable in all versions up to and including 1.2.6. Any WordPress installation running this plugin with that version number or earlier is at risk. The vulnerability requires the attacker to have authenticated WordPress access at Contributor level or above, so sites with strict user role policies face lower risk than those granting broad publishing permissions.

Exploitability

Exploitability is moderate. The attack requires valid WordPress credentials at Contributor level or higher, which narrows the attacker pool compared to unauthenticated vulnerabilities. However, many WordPress sites grant Contributor or Author roles to multiple users—freelancers, agencies, guest bloggers—increasing the risk surface. Once authenticated, crafting the XSS payload is straightforward; no complex exploitation logic is needed. The vulnerability does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date, suggesting active exploitation has not yet been detected at scale, though this should not diminish urgency.

Remediation

Update the CodePeople Post Map for Google Maps plugin to a patched version. Verify the exact fixed version in the official WordPress plugin repository or the vendor's security advisory. Additionally, audit WordPress user roles and remove unnecessary Contributor or higher access. Implement a Web Application Firewall (WAF) rule to detect and block common XSS payloads in POST requests targeting map configuration. Review post meta tables for suspicious 'cpm_point' entries and sanitize or remove them if compromise is suspected.

Patch guidance

Check the WordPress plugin directory and CodePeople's official channels for the availability of a patched version beyond 1.2.6. Most WordPress plugin vulnerabilities are addressed within days to weeks of disclosure. Enable automatic plugin updates if your WordPress configuration allows, or schedule a maintenance window to manually update the plugin. After patching, clear any caches (page cache, CDN) to ensure old, vulnerable pages are no longer served. Test the plugin functionality on a staging environment first to confirm no breaking changes.

Detection guidance

Monitor POST requests and admin-ajax.php calls that modify 'cpm_point' meta data for unusual payloads or encoded JavaScript syntax (such as 'onerror=', 'onclick=', 'javascript:', or base64-encoded strings). Check the wp_postmeta table for suspicious entries in the 'cpm_point' field using SQL queries. Enable WordPress security logging via plugins like Wordfence or Sucuri to capture post meta modifications. Review edit post logs and contributor activity for unusual edits, particularly from accounts that rarely publish. Use a static code analysis tool configured to flag unescaped output in WordPress plugins.

Why prioritize this

This vulnerability warrants high-priority patching despite a MEDIUM CVSS score. The reason: stored XSS affecting web-facing WordPress sites has a long persistence window, impacts all visitors, and is trivial to exploit once authenticated. Unlike remote code execution (which requires more luck), XSS is highly reliable. For sites with high contributor counts or third-party integrations, the authentication barrier is relatively weak. The absence of KEV listing suggests a small but real window to patch before the vulnerability becomes widely weaponized.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects a MEDIUM severity rating derived from: (1) low complexity of exploitation (AC:L), (2) network-based attack vector (AV:N), (3) requirement for low-privilege authentication (PR:L), (4) no user interaction needed for the attack to execute (UI:N), and (5) impact limited to confidentiality and integrity with some scope change (C:L, I:L, A:N). The score would be higher if the vulnerability permitted unauthenticated exploitation or caused availability impact (such as denial of service). In practice, stored XSS affecting a live website often warrants faster remediation than the CVSS suggests due to real-world reputational and legal liability.

Frequently asked questions