PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Vulnerability Details File: lib/previous-map.js Line: 87-98 loadFile, 129-144 loadMap Root Cause PostCSS auto-detects a / sourceMappingURL=... / comment inside the CSS text it is asked to parse and, unless the caller explicitly passes map: false, attempts to load that path from disk as a "previou...

Directory Traversal

Overview postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal via the loadMap process. An attacker can access the contents of arbitrary .map files on the filesystem by submitting crafted CSS containing a...

DEBIAN-CVE-2026-64223

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...

CVE-2026-64223

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...

CVE-2026-64223 wifi: mac80211: consume only present negotiated TTLM maps

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...

CVE-2026-15755

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15755

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-48506

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15755 Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15755 Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15755

The CVE concerns the WordPress plugin Open User Map – Interactive Leaflet Maps (affected versions up to and including 1.4.45). It describes a Stored XSS via shortcode attributes caused by insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access ...

CVE-2025-9205

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...

EUVD-2025-210507

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...

CVE-2025-9205

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...

CVE-2025-9205 MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...

PT-2026-76686

Name of the Vulnerable Software and Affected Versions PostCSS versions prior to 8.5.18 Description PostCSS transforms CSS files into an Abstract Syntax Tree for analysis and modification. A path traversal issue exists in lib/previous-map.js where the loadMap function passes attacker-controlled...

PT-2026-64223

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...

PT-2026-64338

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the mac80211 module of the Linux kernel. The ieee80211 parse neg ttlm function incorrectly advances its cursor for every Traffic Identifier TID, regardles...

PT-2026-64252

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15755: Improper Neutralization of Input During Web Page Generation

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...