CVE-2026-16263

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...

CVE-2026-16265

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...

EUVD-2026-54392

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...

CVE-2026-16263

The WP Maps WordPress plugin versions before 4.9.7 is vulnerable to a Local File Inclusion (LFI) flaw. The root cause is a failure to perform a capability check within an AJAX action and the lack of proper validation for a user-controlled path used in a file inclusion. This allows users with a Su...

CVE-2026-16265

The WP Maps WordPress plugin (versions

CVE-2026-28144 WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6...

CVE-2026-28144 WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6...

WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Maps versions = 4.9.6...

CVE-2026-15381

The WP Go Maps WordPress plugin (versions before 10.1.04 ) is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitise and escape a parameter before including it in a SQL query, specifically identified in the Markers REST filter . An unauthenticate...

CVE-2026-65564 WordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress = 2.97.6 versions...

CVE-2026-25466

Unauthenticated Broken Access Control in WP Go Maps = 10.1.04 versions...

CVE-2026-25466 WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Go Maps = 10.1.04 versions...

WordPress WP Go Maps plugin <= 10.1.05 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin WP Go Maps versions = 10.1.05...

Exploit for CVE-2026-39492

CVE-2026-39492 — WP Maps Blind SQL Injection Scanner Pre-Auth Ti...

WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Google Maps CP versions = 1.2.5...

CVE-2026-13335 CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta

The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpmpoint' Post Meta in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-13335

The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpmpoint' Post Meta in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-13335 CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta

The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpmpoint' Post Meta in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress CodePeople Post Map for Google Maps plugin <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting vulnerability

Authenticated Contributor + Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Google Maps CP versions = 1.2.6...

CVE-2026-12238

The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.1.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers ...