Contact Form Integrated With Google Maps 1.0 - 2.4, Persistent XSS

Due to exposing an AJAX function to anonymous users by using the ‘nopriv’ method of adding an AJAX action, anonymous users are able to insert arbitrary HTML / Javascript onto the site globally.


CVSS Score


CSSS Vector


Attack Scope


Authorization Required



Update to version 2.5

Proof of Concept

The following Python script will result arbitrary Javascript being executed on page load. Any custom HTML content can be inserted into the ‘value’ field, so long as an ‘iframe’ element exists in the provided data

import requests
url = 'http://localhost/wp-admin/admin-ajax.php'
payload = {
r =, data=payload)


  • 2014-09-22: Discovered
  • 2014-09-22: Reported to vendor
  • 2014-09-22: Vendor responded with intent to fix
  • 2014-09-29: Update requested from vendor
  • 2014-09-30: CVE requested
  • 2014-09-02: CVE assigned
  • 2014-10-06: Update requested from vendor
  • 2014-10-11: 2.5 released – issue resolved
  • 2014-10-18: Advisory released