title: WP Go Maps < 9.0.28 - Unauthenticated Stored XSS
description: The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attackers can abuse to store malicious HTML/Javascript on the site.
problem types: CWE-79 Cross-Site Scripting (XSS)
affected:
{
vendor: Unknown
product: WP Go Maps (formerly WP Google Maps)
versions:
status: affected, versionType: semver, version: 0, lessThan: 9.0.28
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}