CVE-2015-7668

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in the includes/MapPinImageSave.php file of the Easy2Map plugin for WordPress, affecting versions before 1.3.0. The map_id parameter is insufficiently sanitized before being output, allowing injection of arbitrary HTML or JavaScript. The plugin has been closed from the WordPress.org directory as of August 8, 2019 due to an unresolved security issue [1].

Exploitation

The attacker does not require authentication; they can craft a malicious URL containing the XSS payload in the map_id parameter and send it to a logged-in administrator. No special privileges or write access is needed. User interaction (clicking the link) is required for the payload to execute in the context of the victim's browser session.

Impact

Successful exploitation enables the attacker to execute arbitrary web scripts in the victim's browser. This can lead to session hijacking, defacement of the admin interface, or theft of sensitive data (e.g., cookies or nonces) within the WordPress admin context. The attack is limited to reflected XSS; it does not directly provide server-side code execution unless combined with another flaw.

Mitigation

The plugin was closed on August 8, 2019 and no patched version (1.3.0 or later) was ever officially distributed to address this issue. No workaround is available. Users must uninstall the plugin immediately and switch to an alternative mapping solution. The plugin is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.