MapFig Studio WordPress Plugin Cross-Site Scripting Vulnerability via Cross-Site Request Forgery

A stored cross-site scripting vulnerability has been identified in the MapFig Studio WordPress plugin, affecting versions through 0.2.1. The issue arises from the plugin's lack of proper cross-site request forgery (CSRF) checks in certain areas, combined with inadequate data sanitization and escaping. This vulnerability could enable attackers to exploit CSRF to inject malicious scripts that would be executed when a logged-in admin user interacts with the affected content.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the content.