CVE-2024-9886: 
WordPress vulnerability analysis and mitigation

The WP Baidu Map plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-9886) in versions up to and including 1.2.2. The vulnerability exists in the plugin's 'baidu_map' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. The plugin was closed on October 28, 2024, due to this security issue (NVD, WordPress Plugin).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue, specifically involving improper neutralization of input during web page generation. It has received a CVSS v3.1 Base Score of 6.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially compromising user data and website security (NVD).

The plugin has been closed and is no longer available for download from the WordPress plugin repository as of October 28, 2024. Users should immediately remove this plugin from their WordPress installations and seek alternative solutions for Baidu Map integration (WordPress Plugin).