886 matches found
My Geo Posts Free <= 1.2 - PHP Object Injection
The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...
Geo Mashup <= 1.13.18 - SQL Injection
Geo Mashup WordPress plugin = 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths. id: CVE-2026-4060 info: name: Geo Mashup = 1.13.18 - SQL Injection author:...
Geo Mashup <= 1.13.17 - SQL Injection
Geo Mashup WordPress plugin = 1.13.17 contains a SQL injection caused by insufficient escaping of the 'sort' parameter, letting unauthenticated attackers extract sensitive database information remotely. id: CVE-2026-2416 info: name: Geo Mashup = 1.13.17 - SQL Injection author: Shivam Kamboj...
WordPress IWS Geo Form Fields <=1.0 - SQL Injection
WordPress IWS Geo Form Fields plugin through 1.0 contains a SQL injection vulnerability. The plugin does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users. An attacker can possibly obtain sensitive information, modify data,...
CVE-2026-72816
A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...
CVE-2026-72816 go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...
CVE-2026-66449
Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...
CVE-2026-66450
Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...
EUVD-2026-57872
Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...
CVE-2026-66450 WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...
CVE-2026-66450
Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...
CVE-2026-66449
Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...
EUVD-2026-57871
Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...
CVE-2026-66449
CVE-2026-66449 : Unauthenticated XSS in WordPress Geo Mashup plugin, affected versions
CVE-2026-66450
CVE-2026-66450 refers to an Unauthenticated Local File Inclusion in the WordPress plugin Geo Mashup, affected versions
CVE-2026-66449 WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...
PT-2026-71559
Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...
CVE-2026-16988
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...
CVE-2026-16988 GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...
