46 matches found
WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation
The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmptempaccessajax AJAX action being registered with wpajaxnopriv and protected only by a nonce check using the...
WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability
SQL Injection vulnerability discovered by johska in WordPress Plugin Maps Marker Pro versions = 4.32...
CVE-2026-18465
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...
EUVD-2026-54392
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...
WordPress Mapster WP Maps plugin < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure vulnerability
Unauthenticated Private and Draft Post Content Disclosure vulnerability discovered by Alexander Jurkschat in WordPress Plugin Mapster WP Maps versions 1.24.0...
CVE-2026-14839 Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...
PT-2026-67051
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...
CVE-2026-28144
The CVE-2026-28144 entry concerns the WordPress WP Maps plugin by Flipper Code, affected up to version 4.9.6. It describes an issue titled “Insertion of Sensitive Information Into Sent Data,” enabling retrieval of embedded sensitive data. The available metrics indicate a CVSS 3.1 base score of 4....
CVE-2026-15381
The WP Go Maps WordPress plugin (versions before 10.1.04 ) is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitise and escape a parameter before including it in a SQL query, specifically identified in the Markers REST filter . An unauthenticate...
PT-2026-66755
Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6...
EUVD-2026-48179
Unauthenticated Cross Site Scripting XSS in WP Google Maps Pro = 10.1.02 versions...
CVE-2026-39492 WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Maps = 4.9.1 versions...
CVE-2026-8935
The WP MAPS PRO WordPress plugin before version 6.1.1 is vulnerable to unauthenticated administrator account creation. The plugin registers an unauthenticated AJAX action that, when provided with a valid nonce—which is publicly emitted on any frontend page enqueuing its map script—unconditionally...
PT-2026-49384
Unauthenticated SQL Injection in WP Maps = 4.9.1 versions...
WordPress WP Maps plugin < 4.9.3 - Subscriber+ Local File Inclusion vulnerability
Subscriber+ Local File Inclusion vulnerability discovered by Mustafa Ahmed in WordPress Plugin WP Maps versions 4.9.3...
EUVD-2026-34959
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'locationmessages' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping...
CVE-2026-9594
The WP Maps plugin for WordPress (affected versions up to 4.9.4) is vulnerable to a Stored Cross-Site Scripting (XSS) via the location_messages parameter due to insufficient input sanitization and output escaping. The vulnerability requires authenticated access at administrator level or higher, w...
CVE-2025-13364
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'putwpgm' shortcode in all versions up to, and including, 4.8.7. This is due to insufficient input sanitization and output escaping on...
WordPress WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability
Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Yousef Alraddadi - none in WordPress Plugin WP Maps versions = 4.9.4...
