WordPress Leaflet Maps Marker Plugin < 3.12.7 is vulnerable to Cross Site Scripting (XSS)

Software Leaflet Maps Marker Type Plugin Vulnerable versions 3.12.7 Fixed in 3.12.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4677 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 99a82b35c26d Credits Lana Codes...

Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 3.12.7 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. PoC mapsmarker lot='1' lat='1' mapwidth='" onmouseover="alert1"'...

Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 3.12.7 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. mapsmarker lot='1' lat='1' mapwidth='" onmouseover="alert1"'...

CVE-2022-1123

The Leaflet Maps Marker Google Maps, OpenStreetMap, Bing Maps WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks...

CVE-2022-1123

The Leaflet Maps Marker Google Maps, OpenStreetMap, Bing Maps WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks...

CVE-2022-1123

The Leaflet Maps Marker Google Maps, OpenStreetMap, Bing Maps WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks...

Sql injection

The Leaflet Maps Marker Google Maps, OpenStreetMap, Bing Maps WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks...

CVE-2022-1123 Leaflet Maps Marker < 3.12.5 - Admin+ SQLi

The Leaflet Maps Marker Google Maps, OpenStreetMap, Bing Maps WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks...

CVE-2022-1123

CVE-2022-1123 affects the WordPress plugin Leaflet Maps Marker prior to version 3.12.5. The issue is improper sanitization of certain parameters before they are inserted into SQL queries, enabling SQL injection by high-privilege users (no user interaction required). The vulnerability is documente...

PT-2022-13672 · WordPress · Leaflet Maps Marker

Name of the Vulnerable Software and Affected Versions: Leaflet Maps Marker WordPress plugin versions prior to 3.12.5 Description: The issue concerns the improper sanitization of certain parameters before they are inserted into SQL queries. This could allow high privilege users to perform SQL...

WordPress plugin Leaflet Maps Marker SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Leaflet Maps Marker Google...

WordPress Leaflet Maps Marker plugin <= 3.12.4 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Ihor Bliumental in WordPress Leaflet Maps Marker plugin versions = 3.12.4. Solution Update the WordPress Leaflet Maps Marker plugin to the latest available version at least 3.12.5...

Leaflet Maps Marker < 3.12.5 - Admin+ SQLi

The plugin does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks. PoC PoC for filter-operator1 parameter: POST...

Malicious code in leaflet-opencage-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a074d348f77e2b6339039eb5785f941733ce3570fd2d7b1bc7063d905b8ad7c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4271 Malicious code in leaflet-opencage-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a074d348f77e2b6339039eb5785f941733ce3570fd2d7b1bc7063d905b8ad7c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Locations and Areas – Leaflet Map with Region Tabs plugin <= 1.7.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Locations and Areas – Leaflet Map with Region Tabs plugin versions = 1.7.0. Solution Update the WordPress Locations and Areas – Leaflet Map with Region Tabs plugin to the latest available version at least 1.7.1...

WordPress Locations and Areas – Leaflet Map with Region Tabs plugin <= 1.7.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Locations and Areas – Leaflet Map with Region Tabs plugin versions = 1.7.0. Solution Update the WordPress Locations and Areas – Leaflet Map with Region Tabs plugin to the latest available version at...

CVE-2021-24467

The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the...

CVE-2021-24467

The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the...

CVE-2021-24467

The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the...