Design/Logic Flaw

The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectanglename or rectangleopacity parameter...

CVE-2019-14792

The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectanglename or rectangleopacity parameter...

CVE-2019-14792

The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectanglename or rectangleopacity parameter...

CVE-2019-14792

The CVE-2019-14792 entry applies to the WordPress WP Google Maps plugin prior to version 7.11.35. The vulnerability arises from an XSS flaw in the plugin via the wp-admin/ rectangle_name or rectangle_opacity parameters, caused by insufficient input validation/sanitization. Public sources in the c...

PT-2019-13837 · WordPress · Wp Google Maps

Name of the Vulnerable Software and Affected Versions: WP Google Maps plugin versions prior to 7.11.35 Description: The issue allows for XSS attacks via the "wp-admin/" endpoint, specifically through the rectangle name or rectangle opacity parameters. Recommendations: For versions prior to 7.11.3...

CVE-2019-14792: Improper Neutralization of Input During Web Page Generation

The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectanglename or rectangleopacity parameter...

WordPress WP Google Maps plugin <= 7.11.34 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found in WordPress WP Google Maps plugin versions = 7.11.34. Solution Update the WordPress WP Google Maps plugin to the latest available version at least 7.11.35...

WP Google Maps <= 7.11.34 - CSRF to Stored XSS

Lack of CSRF and authorisation checks, as well as sanitisation in the wpgmapshead function in legacy-core.php can lead to stored XSS issues...

WordPress Google Maps Plugin SQL Injection (CVE-2019-10692)

An SQL injection vulnerability exists in the WordPress Google Maps Plugin. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

WordPress WP Google Maps plugin <= 7.11.27 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found in WordPress WP Google Maps plugin versions = 7.11.27. Solution Update the WordPress WP Google Maps plugin to the latest available version at least 7.11.28...

WP Google Maps <= 7.11.27 - Admin Settings CSRF

The WP Google Maps WordPress plugin was affected by an Admin Settings CSRF security vulnerability...

WordPress wp-google-maps plugin input validation error vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-google-maps plugin is a Google Maps plugin used in it. An input validation error vulnerability exists in the...

WP Google Maps for WordPress < 7.11.17 Unauthenticated SQL Injection (CVE-2019-10692)

The WP Google Maps plugin for WordPress running on the remote web server is affected by an SQL injection SQLi vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulti...

CVE-2019-10692

In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement...

Design/Logic Flaw

In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement...

CVE-2019-10692

In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement...

CVE-2019-10692

Affected software: WordPress WP Google Maps plugin (versions before 7.11.18). Vulnerability details: The REST API implementation in includes/class.rest-api.php does not sanitize field names before a SELECT statement, enabling an SQL injection. Public descriptions and templates consistently state ...

WP Google Maps 7.11.00-7.11.17 - Unauthenticated SQL Injection

The includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement, leading to an unauthenticated SQL injection issue. PoC curl -k --silent "http://example.com/index.php?restroute=3D/wpgmza/v1/markers/=3D%7B%7D&=fields=3D+from+wpusers+--+-"...

WP Google Maps 7.11.00-7.11.17 - Unauthenticated SQL Injection

The includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement, leading to an unauthenticated SQL injection issue. curl -k --silent "http://example.com/index.php?restroute=3D/wpgmza/v1/markers/&filter=3D%7B%7D&=fields=3D+from+wpusers+--+-"...

WordPress WP Google Maps plugin <= 7.11.17 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability found by Thomas Chauchefoin in WordPress WP Google Maps plugin versions = 7.11.17. Solution Update the WordPress WP Google Maps plugin to the latest available version at least 7.11.18...