CVE-2026-0563

WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode

View on CVE.org

Published Jan 9, 2026 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpgsv_map' shortcode in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

The pagup:WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress contains a stored cross‑site scripting vulnerability that allows an authenticated attacker with contributor or higher privileges to inject arbitrary JavaScript into the 'wpgsv_map' shortcode. The injected script is stored in the database and is executed whenever any user views a page or post containing the affected shortcode.

Affected Systems

All WordPress sites running the pagup:WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin up to and including version 1.1.8 are affected. The vulnerability manifests when a page or post uses the 'wpgsv_map' shortcode within these versions; sites that do not use the plugin or shortcode are not impacted.

Risk and Exploitability

The CVSS score of 6.4 classifies the issue as medium severity, while the EPSS score of less than 1% indicates a low probability of automated exploitation. The vulnerability requires authenticated contributor‑level access or higher to inject scripts, and it is not currently listed in the CISA KEV catalog, which suggests no widely documented exploitation at this time.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

pagup

WP Google Street View (with 360° virtual tour) & Google maps + Local SEO

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.1.8

No data.

Vendor	Product	Versions
Pagup	Wp Google Street View & Google Maps + Local Seo	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the pagup:WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin to a version newer than 1.1.8 that removes the stored XSS flaw.
If an upgrade cannot be performed immediately, delete or disable the 'wpgsv_map' shortcode from existing posts and restrict contributor‑level accounts to prevent future script injection.
Audit content that has used the 'wpgsv_map' shortcode for inserted scripts and remove any malicious code from the database.

Generated by OpenCVE AI on April 16, 2026 at 08:44 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.217% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/changeset/3432185/wp-google-street-view/trunk/includes/shortcode.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/2bc8a3fb-176e-4bf0-b96e-6ccb9688254b?source=cve

History

Jan 9, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 9, 2026 1:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Pagup Pagup wp Google Street View & Google Maps + Local Seo Wordpress Wordpress wordpress
Vendors & Products		Pagup Pagup wp Google Street View & Google Maps + Local Seo Wordpress Wordpress wordpress

Jan 9, 2026 6:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpgsv_map' shortcode in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/changeset/3432185/wp-google-street-view/trunk/includes/shortcode.php https://www.wordfence.com/threat-intel/vulnerabilities/id/2bc8a3fb-176e-4bf0-b96e-6ccb9688254b?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`