WordPress Mapster WP Maps plugin < 2.0.6 - Unauthenticated Arbitrary Post Modification vulnerability

Unauthenticated Arbitrary Post Modification vulnerability discovered by Usama Arshad in WordPress Plugin Mapster WP Maps versions 2.0.6...

CVE-2026-118638

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...

EUVD-2026-114588

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...

CVE-2026-118638 Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...

CVE-2026-118638

The Mapster WP Maps WordPress plugin versions before 2.0.6 is vulnerable to an unauthenticated arbitrary post modification vulnerability. The root cause is a missing authorization check on a REST API route used to write post data (specifically identified in some records as the save-mapmaker route...

CVE-2026-118638: Unknown Mapster WP Maps: The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that…

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...

CVE-2026-107743

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permissioncallback that unconditionally returns true no capability check, no...

EUVD-2026-112692

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permissioncallback that unconditionally returns true no capability check, no...

CVE-2026-107743

The Mapster WP Maps plugin for WordPress (versions

WordPress Mapster WP Maps plugin <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by whatm in WordPress Plugin Mapster WP Maps versions = 2.0.5...

CVE-2026-39720

Unauthenticated Cross Site Scripting XSS in Mapster WP Maps = 2.0.4 versions...

CVE-2026-39720 WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Mapster WP Maps = 2.0.4 versions...

EUVD-2026-93244

Unauthenticated Cross Site Scripting XSS in Mapster WP Maps = 2.0.4 versions...

CVE-2026-39720 WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Mapster WP Maps = 2.0.4 versions...

CVE-2026-39720

The Mapster WP Maps WordPress plugin (versions

PT-2026-106409

Unauthenticated Cross Site Scripting XSS in Mapster WP Maps = 2.0.4 versions...

CVE-2026-39720: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Mapster WP Maps = 2.0.4 versions...

WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Mapster WP Maps versions = 2.0.4...

WordPress Mapster WP Maps plugin <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write vulnerability

Authenticated Subscriber+ Arbitrary User Meta Write vulnerability discovered by Wordfence PRISM in WordPress Plugin Mapster WP Maps versions = 1.23.0...

CVE-2026-12954

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...