CVE-2024-5994

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions up to, and including, 9.0.38. This makes it possible for authenticated attackers that have been explicitly granted permissions by an administrator, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Version 9.0.39 adds a caution to make administrators aware of the possibility for abuse if permissions are granted to lower-level users.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/html/atlas-novus/settings-page.html.php#L442Product
• https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/html/settings-page.html.php#L538Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/dd0597d2-07ba-4fb4-bf73-95770f8c3d6b?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/html/atlas-novus/settings-page.html.php#L442Product
• https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/html/settings-page.html.php#L538Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/dd0597d2-07ba-4fb4-bf73-95770f8c3d6b?source=cveThird Party Advisory

Published

Jun 14, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5988Due to an improper input validation, an unauthenticated thre…9.8
• CVE-2024-5989Due to an improper input validation, an unauthenticated thre…9.8
• CVE-2024-5990Due to an improper input validation, an unauthenticated thre…7.5
• CVE-2024-5991In function MatchDomainName(), input param str is treated as…7.5
• CVE-2024-5992The Cliengo – Chatbot plugin for WordPress is vulnerable to …6.5
• CVE-2024-5993The Cliengo – Chatbot plugin for WordPress is vulnerable to …5.4
• CVE-2024-5995The notification emails sent by Soar Cloud HR Portal contain…8.8
• CVE-2024-5996Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-5997The Duplica – Duplicate Posts, Pages, Custom Posts or Users …4.3
• CVE-2024-5998A vulnerability in the FAISS.deserialize_from_bytes function…7.8
• CVE-2024-6000The FooEvents for WooCommerce plugin for WordPress is vulner…7.1
• CVE-2024-6001An improper certificate validation vulnerability was reporte…8.1