CVE-2020-12077

The WordPress plugin MapPress Maps for WordPress (mappress-google-maps-for-wordpress) is affected by CVE-2020-12077: versions before 2.53.9 implement AJAX actions without nonce or proper capability checks, enabling Remote Code Execution via admin-ajax.php. Red Hat and NVD entries corroborate the ...

CVE-2022-0208

The WordPress MapPress Maps plugin is affected: pre-2.73.4 versions do not sanitize/escape the mapid parameter in the Bad mapid error, enabling reflected XSS. Impact: injected scripts could run in users’ browsers when viewing affected pages. Affected component: MapPress Maps for WordPress (WordPr...

CVE-2023-26015

CVE-2023-26015 pertains to the WordPress MapPress Maps for WordPress plugin (

CVE-2023-4840

MapPress Maps for WordPress (a WordPress plugin) has a stored XSS in the mappress shortcode for versions up to 2.88.4 caused by insufficient input sanitization and output escaping of user-supplied attributes. Exploitation requires an authenticated attacker with contributor-level permissions or hi...

CVE-2023-6524

CVE-2023-6524 concerns MapPress Maps for WordPress. The vulnerability is a stored Cross-Site Scripting (XSS) in the map title parameter, exploitable in all versions up to and including 2.88.13 due to insufficient input sanitization and output escaping. The issue requires an authenticated attacker...

CVE-2022-0537

CVE-2022-0537 affects MapPress Maps for WordPress before 2.73.13. A high-privileged user can bypass DISALLOW_FILE_EDIT/DISALLOW_FILE_MODS and upload arbitrary files via the ajax_save function. The uploaded file is written relative to the current theme/stylesheet directory and given a .php extensi...

CVE-2023-7225

CVE-2023-7225 – MapPress Maps for WordPress : Stored XSS in width/height parameters affects all versions up to 2.88.16 due to insufficient input sanitization and output escaping. Exploitation requires authentication with at least contributor privileges, enabling attackers to inject script that ru...

CVE-2025-2055

CVE-2025-2055 concerns the WordPress plugin MapPress Maps for WordPress. Connected sources confirm the vulnerability is a stored Cross-Site Scripting (XSS) issue in MapPress Maps for WordPress prior to version 2.94.9, caused by insufficient sanitisation/escaping of certain parameters when output ...

CVE-2025-2162

CVE-2025-2162 : MapPress Maps for WordPress plugin, versions before 2.94.10, contains insufficient sanitization/escaping of settings. This enables Stored XSS by high-privilege users (e.g., admin) even when unfiltered_html is disabled (such as in multisite). Root cause: lack of proper input saniti...

CVE-2020-12675

The CVE-2020-12675 entry concerns the WordPress plugin mappress-google-maps-for-wordpress, version prior to 2.54.6. Affected component: the plugin’s AJAX-related code (creation/retrieval/deletion of PHP template files) with insufficient capability checks, enabling Remote Code Execution. Root caus...

CVE-2024-10715

CVE-2024-10715 is a stored XSS vulnerability in the MapPress Maps for WordPress plugin for WordPress, affecting all versions up to 2.94.1. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Map block, enabling an authenticated attacker wit...

CVE-2024-8620

CVE-2024-8620 affects the WordPress plugin MapPress Maps for WordPress, specifically versions prior to 2.93. The issue is that certain settings are not properly sanitized/escaped, enabling Stored Cross-Site Scripting by high-privilege users (e.g., admins), even when unfiltered_html is disallowed ...