Creativemindssolutions
Monthly
Remote code execution is possible in CM Map Locations WordPress plugin (all versions ≤ 2.1.8) via a limited arbitrary file upload flaw in the uploadMedia function, exploitable by any subscriber-level authenticated user. The upload handler performs only incomplete extension filtering with no MIME-type checks or WordPress capability verification before passing attacker-supplied files to move_uploaded_file(), and the required nonce is automatically exposed to any logged-in subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor. No public exploit has been identified at time of analysis, but the low privilege bar and self-service nonce retrieval make this a realistic, high-priority threat for sites with open registration.
Stored cross-site scripting in the CM Business Directory WordPress plugin (all versions ≤ 1.5.7) allows contributor-level authenticated users to persist arbitrary JavaScript in business listing address meta fields, executing against any visitor who loads the affected page. The vulnerability exploits a structural gap in WordPress's permission model: because the payload is written to post meta rather than post_content, the platform's native unfiltered_html capability check never fires, giving low-privilege contributors an injection vector that WordPress's architecture was designed to prevent. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though Wordfence has published full technical details including exact vulnerable code line references and an upstream fix commit.
CM Custom Reports - Flexible reporting to track what matters most plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in admin settings that allows authenticated administrators to inject arbitrary web scripts. The vulnerability affects all versions up to and including 1.2.7 and is caused by insufficient input sanitization and output escaping in the GraphModule.php file. While the CVSS score of 4.4 is moderate, exploitation is restricted to high-privilege authenticated attackers on multi-site WordPress installations or where unfiltered_html has been disabled, making real-world exploitability dependent on specific WordPress configurations.
Remote code execution is possible in CM Map Locations WordPress plugin (all versions ≤ 2.1.8) via a limited arbitrary file upload flaw in the uploadMedia function, exploitable by any subscriber-level authenticated user. The upload handler performs only incomplete extension filtering with no MIME-type checks or WordPress capability verification before passing attacker-supplied files to move_uploaded_file(), and the required nonce is automatically exposed to any logged-in subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor. No public exploit has been identified at time of analysis, but the low privilege bar and self-service nonce retrieval make this a realistic, high-priority threat for sites with open registration.
Stored cross-site scripting in the CM Business Directory WordPress plugin (all versions ≤ 1.5.7) allows contributor-level authenticated users to persist arbitrary JavaScript in business listing address meta fields, executing against any visitor who loads the affected page. The vulnerability exploits a structural gap in WordPress's permission model: because the payload is written to post meta rather than post_content, the platform's native unfiltered_html capability check never fires, giving low-privilege contributors an injection vector that WordPress's architecture was designed to prevent. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though Wordfence has published full technical details including exact vulnerable code line references and an upstream fix commit.
CM Custom Reports - Flexible reporting to track what matters most plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in admin settings that allows authenticated administrators to inject arbitrary web scripts. The vulnerability affects all versions up to and including 1.2.7 and is caused by insufficient input sanitization and output escaping in the GraphModule.php file. While the CVSS score of 4.4 is moderate, exploitation is restricted to high-privilege authenticated attackers on multi-site WordPress installations or where unfiltered_html has been disabled, making real-world exploitability dependent on specific WordPress configurations.