CVE-2014-4587

MEDIUM 4.3 CVSS 2.0

Published: July 2, 2014
Last modified: June 17, 2026
NVD status: Modified
Reported by: cve@mitre.org
Weakness: CWE-79
CVSS vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Description

Multiple cross-site scripting (XSS) vulnerabilities in the WP GuestMap plugin 1.8 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) zl, (2) mt, or (3) dc parameter to guest-locator.php; the (4) zl, (5) mt, (6) activate, or (7) dc parameter to online-tracker.php; the (8) zl, (9) mt, or (10) dc parameter to stats-map.php; or the (11) zl, (12) mt, (13) activate, or (14) dc parameter to weather-map.php.

Affected products and versions

n/a n/a — Versions not specified
wp_guestmap_project wp_guestmap_project — Up to and including 1.8

References

codevigilant.com http://codevigilant.com/disclosure/wp-plugin-wp-guestmap-a3-cross-site-scripting-xss Exploit
www.securityfocus.com http://www.securityfocus.com/bid/68403 Exploit
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References