CVE-2024-9028

Vulnerability

Overview The WP GPX Maps plugin for WordPress, up to version 1.7.08, contains a stored cross-site scripting (XSS) vulnerability in its '[sgpx]' shortcode. The plugin fails to properly sanitize user-supplied attributes and escape output, enabling attackers with contributor-level access or higher to inject arbitrary web scripts [1]. These scripts execute when other users access the affected page.

Exploitation

Prerequisites An attacker must have at least a WordPress contributor account to exploit this vulnerability. The attack is performed by injecting malicious JavaScript through the shortcode attributes when creating or editing a post or page containing the [sgpx] shortcode [1]. No additional authentication is needed from the victim; simply visiting the compromised page triggers the payload.

Impact

Successful exploitation allows an authenticated attacker to perform actions such as stealing session cookies, redirecting users to malicious sites, or defacing the WordPress site. Since the script is stored and executed in the context of the victim's browser, it can potentially lead to privilege escalation if an administrator views the page [1].

Mitigation

The vendor has addressed this issue in version 1.7.09 of the WP GPX Maps plugin [1]. Users are strongly advised to update to the latest version immediately. No workarounds are provided; removing or restricting contributor accounts may reduce risk but does not eliminate it.