Veille CVE

Recherche « Unknown WP MAPS PRO »

8 CVE

Critique 1 Élevée 3 Moyenne 3 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown WP MAPS PRO » ✕
  1. CVE-2026-18465 6.5 Moyenne

    Unknown WP MAPS PRO

    The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.

  2. CVE-2026-18464 7.5 Élevée

    Unknown WP MAPS PRO

    The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.

  3. CVE-2026-16263 8.8 Élevée

    Unknown WP Maps

    The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.

  4. CVE-2026-15381 3.7 Faible

    Unknown WP Go Maps

    The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

  5. CVE-2026-8935 9.8 Critique

    Unknown WP MAPS PRO

    The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.

  6. CVE-2026-8386 5.3 Moyenne

    Unknown WP Go Maps

    The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.

  7. CVE-2026-8385 5.3 Moyenne

    Unknown WP Go Maps

    The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields.

  8. CVE-2026-6381 7.5 Élevée

    Unknown WP Maps

    The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks.