CVE-2026-39720

Unauthenticated Cross Site Scripting XSS in Mapster WP Maps = 2.0.4 versions...

EUVD-2026-93244

Unauthenticated Cross Site Scripting XSS in Mapster WP Maps = 2.0.4 versions...

CVE-2026-39720 WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Mapster WP Maps = 2.0.4 versions...

CVE-2026-39720

The Mapster WP Maps WordPress plugin (versions

CVE-2026-39720 WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Mapster WP Maps = 2.0.4 versions...

PT-2026-106409

Unauthenticated Cross Site Scripting XSS in Mapster WP Maps = 2.0.4 versions...

WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Mapster WP Maps versions = 2.0.4...

WordPress Mapster WP Maps plugin <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write vulnerability

Authenticated Subscriber+ Arbitrary User Meta Write vulnerability discovered by Wordfence PRISM in WordPress Plugin Mapster WP Maps versions = 1.23.0...

CVE-2026-12954

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-12954 Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-12954 Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

EUVD-2026-82756

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-12954

The Mapster WP Maps WordPress plugin (≤ 1.23.0) is vulnerable to Arbitrary User Meta Write via the my_profile_update() function. The function performs no nonce verification, capability check, or allowlist validation on the meta key supplied through the acf-photo-gallery-groups POST parameter befo...

CVE-2026-12954: Improper Input Validation

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

PT-2026-95282

Name of the Vulnerable Software and Affected Versions Mapster WP Maps versions prior to 1.23.1 Description The plugin contains an Arbitrary User Meta Write flaw within the my profile update function. The issue occurs because the function fails to perform nonce verification, capability checks, and...

CVE-2026-14839

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

EUVD-2026-51711

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

CVE-2026-14839

The Mapster WP Maps WordPress plugin (versions before 1.24.0 ) contains a vulnerability where it fails to perform authorization or post-status checks on a public REST endpoint. This allows unauthenticated users to retrieve the title and full content of any post, including those with statuses such...

CVE-2026-14839: Exposure of Sensitive Information to an Unauthorized Actor

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

WordPress Mapster WP Maps plugin <= 1.9.0 - Unauthenticated Reflected Cross-Site Scripting vulnerability

Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Mapster WP Maps versions = 1.9.0...