CVE-2026-56011: Unauthenticated XSS in MapPress Maps WordPress Plugin ≤2.97.3

Technical summary

CVE-2026-56011 is a reflected or stored XSS vulnerability (CWE-79) in MapPress Maps for WordPress that does not require authentication to exploit. The plugin fails to properly sanitize and escape user-supplied input before rendering it in the web page. The vulnerability is triggered when an unauthenticated user visits a specially crafted link or page containing the malicious payload. With a CVSS v3.1 score of 7.1 (HIGH), the vulnerability requires user interaction but has a network attack vector and can affect the confidentiality, integrity, and availability of the WordPress site and its visitors.

Business impact

An active XSS vulnerability on a WordPress site can erode visitor trust, expose customer data, and damage your organization's reputation. If exploited at scale, it could inject credential-stealing forms or redirect users to malicious sites. For e-commerce or service-delivery sites, this creates legal liability and may trigger data breach notification requirements. Site owners face potential SEO penalties if search engines detect malicious content injection.

Affected systems

MapPress Maps for WordPress versions 2.97.3 and earlier are affected. The vulnerability is unauthenticated, meaning any WordPress site running this plugin version is at risk regardless of login restrictions. Multisite installations are also vulnerable. Check your installed plugin version in the WordPress admin dashboard under Plugins.

Exploitability

The vulnerability is readily exploitable and does not require valid credentials or special system access. An attacker only needs to craft a malicious URL or inject a payload into a location the plugin will display. User interaction (clicking a link or viewing a page) is necessary to trigger the attack, which is a low friction requirement for many social engineering scenarios. The lack of complexity in the attack vector and the unauthenticated nature make this a high-risk vulnerability.

Remediation

Update MapPress Maps to a patched version released after 2.97.3. Verify the specific patched version against the plugin vendor's advisory and security announcements. If an immediate patch is unavailable, consider temporarily deactivating the plugin until a fix is released, or implement Web Application Firewall (WAF) rules to block known payload patterns. Always maintain current WordPress core and plugin versions as part of regular maintenance.

Patch guidance

Visit the MapPress plugin page on WordPress.org or the vendor's website to confirm the latest available version and download it directly. Apply the patch through the WordPress admin dashboard (Plugins > Updates) or via manual upload. Test the update on a staging environment first to ensure compatibility with your site configuration and other active plugins. After patching, clear any caching layers and verify that the plugin functions correctly.

Detection guidance

Review access logs and WAF logs for HTTP requests containing common XSS payload patterns (e.g., <script>, javascript:, onerror=, onload=). Monitor for unusual script execution in network traffic. Use browser developer tools to inspect site pages for unexpected script tags or iframes. Conduct a site audit with security scanning tools (e.g., Sucuri, Wordfence) to detect injected malicious content. If your site was running an unpatched version during the disclosure period, assume compromise until proven otherwise via forensic analysis.

Why prioritize this

This vulnerability scores HIGH on the CVSS scale and combines a network attack vector, low attack complexity, no authentication requirement, and user interaction as the only barrier. The plugin's purpose (displaying maps) makes it likely to be visible to all site visitors, maximizing exposure. Unauthenticated XSS on a public-facing WordPress plugin should be treated as critical for any site accepting user traffic.

Risk score, explained

CVSS 7.1 (HIGH) reflects the combination of: network-accessible attack surface (AV:N), low complexity to execute (AC:L), no privilege or authentication required (PR:N), moderate impact to confidentiality and integrity, and user interaction as a limiting factor (UI:R). The scope change (S:C) indicates the attack can affect resources beyond the plugin itself, including the broader WordPress environment and visitor browsers. While not critical, this is a high-priority fix.

Frequently asked questions