86 matches found
WordPress Mapster WP Maps plugin < 2.0.6 - Unauthenticated Arbitrary Post Modification vulnerability
Unauthenticated Arbitrary Post Modification vulnerability discovered by Usama Arshad in WordPress Plugin Mapster WP Maps versions 2.0.6...
CVE-2026-118638
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...
CVE-2026-118638
The Mapster WP Maps WordPress plugin versions before 2.0.6 is vulnerable to an unauthenticated arbitrary post modification vulnerability. The root cause is a missing authorization check on a REST API route used to write post data (specifically identified in some records as the save-mapmaker route...
EUVD-2026-114588
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...
CVE-2026-118638 Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...
CVE-2026-118638 Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...
PT-2026-134432
Name of the Vulnerable Software and Affected Versions Mapster WP Maps WordPress plugin versions prior to 2.0.6 Description An authorization bypass exists in a REST API route used for writing post data. This allows unauthenticated attackers to overwrite the titles of arbitrary posts, create new...
CVE-2026-118638: Unknown Mapster WP Maps: The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that…
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...
CVE-2026-107743
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permissioncallback that unconditionally returns true no capability check, no...
CVE-2026-107743 Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permissioncallback that unconditionally returns true no capability check, no...
CVE-2026-107743
The Mapster WP Maps plugin for WordPress (versions
EUVD-2026-112692
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permissioncallback that unconditionally returns true no capability check, no...
CVE-2026-107743 Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permissioncallback that unconditionally returns true no capability check, no...
WordPress Mapster WP Maps plugin <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by whatm in WordPress Plugin Mapster WP Maps versions = 2.0.5...
PT-2026-130679
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permission callback that unconditionally returns true no capability check, no...
CVE-2026-107743: mapster Mapster WP Maps: The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,…
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permissioncallback that unconditionally returns true no capability check, no...
WordPress Mapster WP Maps cross-site scripting vulnerability
WordPress Mapster WP Maps versions 2.0.5 and earlier contain a cross-site scripting vulnerability. This vulnerability arises because REST route permission callbacks return true unconditionally, improper sanitization of configuration values, and lack of escaping. As a result, stored cross-site...
CVE-2026-39720
Unauthenticated Cross Site Scripting XSS in Mapster WP Maps = 2.0.4 versions...