CVE-2026-13726

CVE-2026-13726 is a reflected cross-site scripting vulnerability in the MapPress Google Maps plugin for WordPress (MPG), affecting versions prior to 4.1.8. The bug lives in an unauthenticated endpoint that takes URL parameters and reflects them into the HTML output without proper escaping — specifically, the plugin fails to apply context-aware output encoding when rendering user-supplied values. The practical impact breaks down into two tiers. For site operators: update to 4.1.8 immediately. This is a straightforward patch — there's no configuration change required, no compatibility concern that should delay you. For defenders building detection rules: monitor for requests to any MPG endpoint that contain HTML-special-character sequences (<script, javascript:, onerror=) in URL parameters, particularly those matching the plugin's mapping query parameters. The vulnerable endpoint is directly accessible without authentication, meaning your WAF or log analysis can catch exploitation attempts directly. What distinguishes this from a critical remote code execution: the CVSS 7.1 score reflects the social engineering prerequisite — attackers must induce a user into clicking a crafted link. This makes reflected XSS a phishing force multiplier rather than an autonomous compromise vector. Your priority ordering should reflect this: patch the plugin (primary), then audit administrative users who might click links (secondary), then deploy WAF rules blocking the parameter patterns (tertiary). The EPSS score of 0.00164 correctly indicates low automated exploitation likelihood, but don't confuse that with low risk for your users. The vulnerable endpoint has been exposed for approximately four years across all sites running older versions. Assume reconnaissance has already mapped this attack surface. The real exposure window is the gap between now and when you complete patching — that's where attackers operate, using this as a credential harvesting mechanism in targeted phishing campaigns rather than mass-exploitation scripts.

Reviewed through automated stages and approved by a human before publication.