7 matches found
CVE-2025-13364
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'putwpgm' shortcode in all versions up to, and including, 4.8.7. This is due to insufficient input sanitization and output escaping on...
CVE-2025-13364
CVE-2025-13364 affects the WordPress plugin “WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters” up to version 4.8.7. The issue is a Stored Cross-Site Scripting (stored‑XSS) flaw caused by insufficient input sanitization and output escaping on user‑supplied ...
CVE-2025-13364: Improper Neutralization of Input During Web Page Generation
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'putwpgm' shortcode in all versions up to, and including, 4.8.7. This is due to insufficient input sanitization and output escaping on...
CVE-2026-2580: Improper Neutralization of Special Elements used in an SQL Command
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 4.9.1 due to insufficient escaping on the user supplied parameter and lack of...
CVE-2025-12062: Improper Limitation of a Pathname to a Restricted Directory
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8.6 via the fcloadtemplate function. This makes it possible for authenticated attackers, with Subscriber-leve...
