Medium severity6.4NVD Advisory· Published Jun 27, 2023· Updated Apr 8, 2026
CVE-2023-3412
CVE-2023-3412
Description
The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.0. This is due to a missing capability check on the ajax_store_save() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify plugin settings and inject malicious web scripts.
Affected products
1- cpe:2.3:a:webcraftplugins:image_map_pro:*:*:*:*:lite:wordpress:*:*Range: <=1.0.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.