CVE-2026-102395
HighCVSS 7.1Summary
The Easy Google Maps plugin versions 1.14.6 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
Risk Assessment
Risk of session theft, cookie theft, or other user data compromise, as well as account takeover.
Recommendation
Update the Easy Google Maps plugin to the latest version that includes the fix.
Other vulnerabilities in Easy Google Maps
See all- CVE-2026-73366Critical
Unauthenticated PHP Object Injection vulnerability in Easy Google Maps plugin versions up to 1.13.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.
- CVE-2026-73367High
Unauthenticated Remote File Inclusion vulnerability in Easy Google Maps versions prior to 1.14.2.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS