76 matches found
CVE-2026-18465
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...
CVE-2026-18464
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...
EUVD-2026-54878
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...
PT-2026-69275
Name of the Vulnerable Software and Affected Versions WP MAPS PRO versions prior to 6.1.3 Description An issue exists where a capability check is missing in an AJAX action available to unauthenticated users. The plugin fails to properly validate a user-controlled path used in a file inclusion...
CVE-2026-18465: Improper Limitation of a Pathname to a Restricted Directory
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...
PT-2026-69274
Name of the Vulnerable Software and Affected Versions WP MAPS PRO versions prior to 6.1.3 Description An issue exists where the plugin fails to perform a capability check in an AJAX action available to unauthenticated users. Because the operation it dispatches is not restricted, unauthenticated...
CVE-2026-18464: Uncontrolled Resource Consumption
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...
CVE-2026-57767
Unauthenticated Cross Site Scripting XSS in WP Google Maps Pro = 10.1.02 versions...
CVE-2026-57767 WordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Google Maps Pro = 10.1.02 versions...
CVE-2026-57767
WP Google Maps Pro plugin <= 10.1.02 has an unauthenticated Cross Site Scripting (XSS) vulnerability. Affects versions
CVE-2026-57767 WordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Google Maps Pro = 10.1.02 versions...
EUVD-2026-48179
Unauthenticated Cross Site Scripting XSS in WP Google Maps Pro = 10.1.02 versions...
PT-2026-63837
Unauthenticated Cross Site Scripting XSS in WP Google Maps Pro = 10.1.02 versions...
CVE-2026-57767: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WP Google Maps Pro = 10.1.02 versions...
WordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Austin Ginder in WordPress Plugin WP Google Maps Pro versions = 10.1.02...
📄 WordPress WP Maps Pro 6.1.0 Authentication Bypass
A vulnerability in the WP Maps Pro plugin for WordPress allows unauthenticated attackers to generate valid authentication tokens via the wpgmptempaccessajax AJAX action. The vulnerability exists because the nonce check can be bypassed, allowing attackers to obtain a temporary access token that...
CVE-2026-8935
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin acces...
CVE-2026-8935 Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account Creation
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin acces...
CVE-2026-8935 Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account Creation
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin acces...
CVE-2026-8935
The WP MAPS PRO WordPress plugin before version 6.1.1 is vulnerable to unauthenticated administrator account creation. The plugin registers an unauthenticated AJAX action that, when provided with a valid nonce—which is publicly emitted on any frontend page enqueuing its map script—unconditionally...