CVE-2026-13179 flippercode CVE debrief

Who should care

Defenders responsible for WordPress installations using the WP Maps plugin, particularly those with users having subscriber-level access and above, should assess exposure and prioritize verification and potential remediation.

Why it matters

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations, particularly for users with subscriber-level access and above, and assess exposure to potential Stored Cross-Site Scripting attacks.

• Authenticated attackers with subscriber-level access can inject arbitrary web scripts
• Injected scripts execute when a user accesses an injected page
• Exposure requires verification due to limited information on affected versions and remediation

Technical summary

The WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator, Listing, Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shapes_values parameter in all versions up to, and including, 4.9.8. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fc-call-nonce nonce required by the endpoint is exposed to all frontend visitors who view a map page via window.wpgmp_local.nonce, enabling any authenticated subscriber to read the nonce and craft a valid request; additionally, the secondary _wpnonce check in the drawing handler can be bypassed by simply omitting the _wpnonce parameter from the request.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure, particularly for users with subscriber-level access and above.

Recommended defensive actions

• Verify the presence of this vulnerability in your WordPress installations
• Assess exposure, particularly for users with subscriber-level access and above
• Consider upgrading to a patched version of the WP Maps plugin
• Monitor for suspicious activity and implement additional security measures to prevent exploitation
• Perform a thorough review of the plugin's configuration and usage
• Implement a Web Application Firewall (WAF) to detect and prevent attacks
• Keep the plugin and WordPress core up-to-date

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD records. The source references provided include links to the WordPress plugin repository and code files, indicating that the vulnerability has been identified and reported by security researchers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.