CVE-2012-10018 Mapplic Lite and Mapplic <= (Various Versions) - Server Side Request Forgery to Cross-Site Scirpting
Attackers can exploit SSRF in Mapplic WordPress plugins to perform XSS attacks by requesting malicious SVG files from the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-10018?
CVE-2012-10018 is a high-severity server-side request forgery vulnerability in sekler Mapplic - Custom Interactive Map WordPress Plugin, published on 16 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively. This makes it possible for attackers to forgery requests coming from a vulnerable site's server and ultimately perform an XSS attack if requesting an SVG file.
Weakness: CWE-918
Which versions are affected by CVE-2012-10018?
It affects 1 product.
Products include Mapplic Mapplic.
How do I fix CVE-2012-10018?
No fix has been published for CVE-2012-10018 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2012-10018 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-10018 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in sekler Mapplic - Custom Interactive Map WordPress Plugin
Sources
Also known as GHSA-v3rv-7532-9gg6.