{
 "id": "WPSEC-2026-3133",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3133/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3133/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3133/index.md",
 "title": "WP GPX Maps <= 1.14.00 - Authenticated (Author+) Stored Cross-Site Scripting via Photo Marker Popups",
 "description": "The WP GPX Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the photo marker popups of the Leaflet map engine in all versions up to, and including, 1.14.00. This is due to the map script reading the photo name from the image's alt attribute, which the browser has already decoded, and inserting it into the popup HTML without escaping. This makes it possible for authenticated attackers with author-level access and above to inject arbitrary web scripts through the alt text of an image attached to a post that displays a map with photos. The scripts execute when a user opens the photo popup on that page.",
 "plugin": {
  "slug": "wp-gpx-maps",
  "name": "WP GPX Maps",
  "full_name": "WP GPX Maps – GPX, FIT & KML maps with elevation profile",
  "wordpress_org": "https://wordpress.org/plugins/wp-gpx-maps/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-gpx-maps/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-gpx-maps"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.6.04",
    "from_inclusive": true,
    "to": "1.14.01",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.6.04 before 1.14.01"
  ]
 },
 "introduced_in": "1.6.04",
 "fixed_in": "1.14.01",
 "remediation": "Update to 1.14.01 or later.",
 "fix_released": "2026-11-13T09:06:58+00:00",
 "published": "2026-11-14T09:40:51+00:00",
 "updated": "2026-11-13T15:54:57.627468+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3133/",
  "https://plugins.svn.wordpress.org/wp-gpx-maps/tags/1.14.01/",
  "https://wordpress.org/plugins/wp-gpx-maps/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-gpx-maps",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-14"
 }
}