Atomic Edge analysis of CVE-2026-57670:
This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the CodePeople Post Map for Google Maps plugin for WordPress, affecting versions up to and including 1.2.5. The vulnerability arises from insufficient input sanitization and output escaping, allowing attackers to inject arbitrary web scripts into pages that execute when a user accesses an injected page. The CVSS score of 7.2 reflects the critical nature of this flaw.
Root Cause: The primary root cause involves multiple code paths where user-supplied data is not properly sanitized or escaped before being stored or rendered. In cp-feedback.php (lines 69-73), the original code iterates over all $_POST parameters and directly assigns their values to an outgoing data array without any sanitization. In functions.php, the `_set_map_config` method (lines 1490-1532) outputs variables like `$display`, `$type`, and `$center` directly into JavaScript strings without escaping, and the `get_marker_options` method (lines 1546-1552) outputs `$point[‘address’]` and `$point[‘info’]` after only basic string replacements but without proper sanitization. Additionally, the `_get_windowhtml` function (lines 1600-1612) builds HTML output using variables like `$point_title`, `$point_link`, and `$point_description` without escaping for the context (HTML attribute vs. body). The `array_map_recursive` calls on `$_POST[‘cpm_point’]` and `$_POST[‘cpm_map’]` do not validate that these are arrays, leading to potential type confusion.
Exploitation: An unauthenticated attacker can exploit this by submitting a crafted POST request to any endpoint that processes the vulnerable feedback form (likely via admin-ajax.php or direct form submission) or by supplying malicious data via post meta fields like `cpm_point` or `cpm_map` when creating or editing a post. For the feedback submission, the attacker sends a request to the plugin’s feedback handler with arbitrary parameters, including a payload like `alert(1)` in a parameter value. Since no sanitization occurs, the payload is forwarded to an external feedback server or stored locally. For the map configuration, if the plugin renders a map with user-supplied shortcode attributes (like `[cpm-map display=”alert(1)”]`), the `_set_map_config` method directly injects the attribute value into the JavaScript output. The attack vector is via the public-facing map display or admin panel, depending on the component.
Patch Analysis: The patch introduces several critical fixes. In cp-feedback.php, the POST iteration is restricted to an allowlist of three parameters (`feedback_message`, `feedback_rating`, `feedback_plugin`), each of which is sanitized using `sanitize_text_field(wp_unslash(…))`. In functions.php, the `_set_map_config` method now wraps `$display`, `$type`, and `$highlight_class` in `esc_js()` to prevent JavaScript injection. The `$center` parameter is validated to ensure it consists of exactly two numeric coordinates before being output. The `_get_windowhtml` function and `get_marker_options` method now use `wp_kses_post()` and `esc_html()`/`esc_url()` for output escaping. Additionally, the `array_map_recursive` calls now check that `$_POST[‘cpm_point’]` and `$_POST[‘cpm_map’]` are arrays before processing, preventing type confusion. Unserialization calls now validate the serialized string format and use `allowed_classes => false`. The `extract()` calls use `EXTR_SKIP` to prevent variable overwriting.
Impact: Successful exploitation allows an unauthenticated attacker to inject arbitrary JavaScript or HTML into pages that other users (including administrators) will view. This can lead to session hijacking, credential theft, redirection to malicious sites, defacement, or theft of sensitive data. Since the vulnerability is stored XSS, the injection persists across page loads and can affect every visitor of the compromised page. In a WordPress context, an admin visiting a page with the injected script could have their session stolen, allowing the attacker to create administrative accounts or install malicious plugins.
