Skip to main content

Mappress CVE-2023-26015

HIGH
SQL Injection (CWE-89)
2023-11-03 audit@patchstack.com
WordPress SQLi Google Mappress Wordpress Plugin Mappresspro
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
Low

Lifecycle Timeline

1
CVE Published
Nov 03, 2023 - 13:15 cve.org
HIGH 7.1

DescriptionCVE.org

A vulnerability in chrisvrichardson MapPress Maps for WordPress mappress-google-maps-for-wordpress.This issue affects MapPress Maps for WordPress: from n/a through <= 2.85.4.

AnalysisAI

A vulnerability in chrisvrichardson MapPress Maps for WordPress mappress-google-maps-for-wordpress.85.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. A vulnerability in chrisvrichardson MapPress Maps for WordPress mappress-google-maps-for-wordpress.85.4. Affected products include: Mappresspro Mappress.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.

More in Mappress

View all
CVE-2020-12077 HIGH POC
8.8 Apr 23

The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions wi
CVE-2022-0537 HIGH POC
7.2 Apr 04

The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and
CVE-2025-2055 MEDIUM POC
6.8 Apr 03

The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in
CVE-2023-7225 MEDIUM POC
6.4 Jan 30

The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and heig
CVE-2023-6524 MEDIUM POC
6.4 Jan 03

The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the map title para
CVE-2025-2162 MEDIUM POC
4.8 Apr 18

The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could all
CVE-2020-12675 HIGH
8.8 May 29

The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks
CVE-2023-4840 MEDIUM
6.4 Sep 12

The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortco
CVE-2024-10715 MEDIUM
5.4 Nov 06

The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map b
CVE-2024-8620 MEDIUM POC
4.8 May 15

The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2023-26015 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy