Veille CVE

Recherche « Unknown WP Maps »

7 CVE

Critique 0 Élevée 3 Moyenne 3 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown WP Maps » ✕
  1. CVE-2026-18466 5.4 Moyenne

    Unknown WP Maps

    The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request.

  2. CVE-2026-18465 6.5 Moyenne

    Unknown WP MAPS PRO

    The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.

  3. CVE-2026-18464 7.5 Élevée

    Unknown WP MAPS PRO

    The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.

  4. CVE-2026-16265 6.5 Moyenne

    Unknown WP Maps

    The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.

  5. CVE-2026-16263 8.8 Élevée

    Unknown WP Maps

    The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.

  6. CVE-2026-14839 7.5 Élevée

    Unknown Mapster WP Maps

    The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts.

  7. CVE-2026-15381 3.7 Faible

    Unknown WP Go Maps

    The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.