CVE-2023-6697: 
WordPress vulnerability analysis and mitigation

The WP Go Maps (formerly WP Google Maps) plugin for WordPress was identified with a Reflected Cross-Site Scripting vulnerability (CVE-2023-6697) affecting all versions up to and including 9.0.28. The vulnerability was discovered by the Nex Team and publicly disclosed on January 24, 2024, with a CVSS v3.1 base score of 6.1 (Medium) (NVD, Wordfence Report).

The vulnerability stems from insufficient input sanitization and output escaping specifically in the map id parameter. This security flaw has been classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability received a CVSS v3.1 score of 6.1 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required (NVD).

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. This can lead to potential data theft and unauthorized actions performed in the context of the victim's browser session (NVD).

The vulnerability requires user interaction to be exploited, typically through social engineering tactics where attackers must trick users into clicking on specially crafted links. No evidence of active exploitation in the wild has been publicly reported (NVD).

A patch has been released to address this vulnerability. Website administrators running WP Go Maps are strongly advised to update their installations to the latest version beyond 9.0.28. The fix has been implemented through a code change that properly sanitizes the map id parameter (WordPress Patch).