Medium severity · published Apr 25, 2022
CVE-2021-46780
The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected…
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EG
Easy Google Maps · Supsystic
before 1.9.32 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-46780
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-46780
Exploit
https://wpscan.com/vulnerability/cba4ccdd-9331-4ca0-b910-8f427ed9b540
More from Easy Google Maps
9.8
CVE-2026-73366
WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability
8.8
CVE-2024-31269
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps.This issue affects Easy Google Maps: from n/a through 1.11.11
8.8
CVE-2023-33926
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions
7.2
CVE-2026-73367
WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability
7.1
CVE-2026-102395
WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability