102 matches found
CVE-2026-8732
CVE-2026-8732 β WP Maps Pro β€ 6.1.0 β‘ Unauthenticated Privilege Escalation via Administrator Account Creation β‘ === shadow β‘ & friska === π Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-8732 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type|...
CVE-2026-39492
CVE-2026-39492 β WP Maps Blind SQL Injection Scanner Pre-Auth Time-Based Blind SQLi via Backtick-Bypass β DB-Extraktion Γbersicht CVE-2026-39492 ist eine kritische CVSS 9.3 nicht authentifizierte blinde SQL-Injection-Schwachstelle im WP Maps -Plugin wp-google-map-plugin in Versionen β€ 4.9.1. Der...
CVE-2026-8732-EXPLOIT
CVE-2026-8732 β ΠΠΊΡΠΏΠ»ΠΎΠΉΡ WordPress WP Maps Pro ΠΠ΅Π°ΡΡΠ΅Π½ΡΠΈΡΠΈΡΠΈΡΠΎΠ²Π°Π½Π½ΡΠΉ Π·Π°Ρ Π²Π°Ρ Π°Π΄ΠΌΠΈΠ½ΠΈΡΡΡΠ°ΡΠΎΡΠ° | CVSS 9.8 | ΠΠΎΡΠΎΠ² ΠΊ ΠΈΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΡ π₯ Π§ΡΠΎ Π²Ρ ΠΏΠΎΠ»ΡΡΠ°Π΅ΡΠ΅ ΠΠΎΠ»Π½ΠΎΡΡΡΡ ΡΠ°Π±ΠΎΡΠΈΠΉ ΡΠΊΡΠΏΠ»ΠΎΠΉΡ Π½Π° Python Π΄Π»Ρ CVE-2026-8732 ΠΠ΅Π°ΡΡΠ΅Π½ΡΠΈΡΠΈΡΠΈΡΠΎΠ²Π°Π½Π½ΠΎΠ΅ ΡΠΎΠ·Π΄Π°Π½ΠΈΠ΅ ΡΡΡΡΠ½ΠΎΠΉ Π·Π°ΠΏΠΈΡΠΈ Π°Π΄ΠΌΠΈΠ½ΠΈΡΡΡΠ°ΡΠΎΡΠ° ΠΠΎΠ·Π²ΡΠ°ΡΠ°Π΅Ρ ΠΌΠ°Π³ΠΈΡΠ΅ΡΠΊΡΡ ΡΡΡΠ»ΠΊΡ Π΄Π»Ρ Π²Ρ ΠΎ...
CVE-2026-8732
βοΈ CVE-2026-8732 WP Maps Pro β€ 6.1.0 β Escalation dei Privilegi Non Autenticata Automazione dell'Exploit in 8 Fasi | Multiprocessing + Asyncio | Creazione Admin Verificata π― Informazioni sulla VulnerabilitΓ Il plugin WordPress WP Maps Pro versione β€ 6.1.0 presenta una vulnerabilitΓ di escalation...
CVE-2026-18466
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...
EUVD-2026-62280
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...
CVE-2026-18466
WP Maps WordPress plugin versions before 4.9.8 contain a missing authorization flaw in one of its AJAX actions. The endpoint lacks both a capability check and nonce validation , allowing any authenticated user with the lowest-level Subscriber role to create an unlimited number of autoloaded optio...
CVE-2026-18466 WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...
CVE-2026-18465
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...
CVE-2026-18464 WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...
CVE-2026-16265
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...
CVE-2026-16263 WP Maps < 4.9.7 - Subscriber+ Local File Inclusion
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...
CVE-2026-16263 WP Maps < 4.9.7 - Subscriber+ Local File Inclusion
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...
CVE-2026-16265 WP Maps < 4.9.7 - Subscriber+ Denial of Service
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...
CVE-2026-14839
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...
CVE-2026-14839
CVE-2026-14839 affects Mapster WP Maps WordPress plugin (
EUVD-2026-51711
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...
CVE-2026-28144
Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6...