10Web Map Builder for Google Maps <= 1.0.69 - Authenticated Stored Cross-Site Scripting

The 10Web Map Builder for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘&map_api_key, &center_address, &center_lat, &center_lng, &zoom_level’ parameters in versions up to, and including, 1.0.69 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was initially reported in 1.0.68 and partially, but not, fully patched, in 1.0.69.