CVE-2026-12954

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...