WP GPX Maps <= 1.14.00 - Authenticated (Author+) Stored Cross-Site Scripting via Photo Marker Popups
- ID
- WPSEC-2026-3133
- Plugin
- WP GPX Maps – GPX, FIT & KML maps with elevation profile (wp-gpx-maps)
- Affected
- from 1.6.04 before 1.14.01
- Remediation
- Update to 1.14.01 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-14
- Attack surface
- WP GPX Maps on WPSec AttackSurface
- Fix released
- Published
Description
The WP GPX Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the photo marker popups of the Leaflet map engine in all versions up to, and including, 1.14.00. This is due to the map script reading the photo name from the image's alt attribute, which the browser has already decoded, and inserting it into the popup HTML without escaping. This makes it possible for authenticated attackers with author-level access and above to inject arbitrary web scripts through the alt text of an image attached to a post that displays a map with photos. The scripts execute when a user opens the photo popup on that page.
References
- https://wpsec.com/vuln/WPSEC-2026-3133/
- https://plugins.svn.wordpress.org/wp-gpx-maps/tags/1.14.01/
- https://wordpress.org/plugins/wp-gpx-maps/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS