Flippercode
Monthly
Local file inclusion in the WP Maps (flippercode) plugin for WordPress, affecting all versions up to and including 4.9.8, allows an authenticated attacker holding subscriber-level access or above to supply a crafted 'page' parameter that reaches the plugin's include logic and pulls in arbitrary local PHP files. File disclosure and access-control bypass are achievable against default configurations, but full remote code execution is conditional, requiring the attacker to additionally place or reference an includable .php file on the server (for example through an upload feature). There is no public exploit identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV).
Remote unauthenticated privilege escalation in the WP Maps Pro WordPress plugin (all versions through 6.1.0) allows attackers to create a new administrator account and authenticate as that user, resulting in complete site takeover. The flaw stems from an AJAX handler exposed to unauthenticated users and protected only by a publicly-embedded nonce, making the access check ineffective. No public exploit identified at time of analysis, but the trivial nature of the bug (default-enabled handler, no authentication, magic login URL returned to the caller) makes weaponization straightforward once details circulate.
A time-based SQL injection vulnerability exists in the WP Maps - Store Locator plugin for WordPress through version 4.9.1, allowing unauthenticated attackers to extract sensitive database information via the insufficiently sanitized 'orderby' parameter. With a CVSS score of 7.5 (High), this vulnerability requires no privileges or user interaction and can be exploited remotely over the network. No KEV listing or EPSS data is provided, but the vulnerability has been publicly disclosed by Wordfence with technical details and code references available.
Stored cross-site scripting in the WordPress plugin WP Maps - Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings (wp-google-map-plugin) in all versions up to and including 4.9.8 allows authenticated attackers holding only subscriber-level access to inject arbitrary JavaScript through the shapes_values parameter, which is insufficiently sanitized on input and unescaped on output. The nominal fc-call-nonce protection is ineffective because that nonce is exposed to every frontend visitor via window.wpgmp_local.nonce on map pages, and the drawing handler's secondary _wpnonce check can be bypassed simply by omitting the _wpnonce parameter from the request. Execution is deferred: the injected script fires when a victim (for example an administrator or any site visitor) later views the page containing the stored shape, and no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Stored Cross-Site Scripting in WP Maps (all versions through 4.9.4) allows authenticated attackers holding the wpgmp_manage_location capability - granted to administrators by default but delegable to lower-privileged roles - to inject persistent malicious scripts via the 'location_messages' parameter. The CVSS scope change (S:C) confirms the injected payload executes across victim browser sessions on any page rendering the affected shortcode, enabling session hijacking or unauthorized actions on behalf of site visitors. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV; however, the delegable capability expands the potential attacker pool beyond pure administrators.
Stored XSS in WP Maps plugin for WordPress allows authenticated contributors to inject malicious scripts via the 'put_wpgm' shortcode due to insufficient input sanitization and output escaping. Attackers with contributor-level access and above can craft malicious shortcode attributes that persist in page content and execute for all subsequent visitors. All versions up to 4.8.7 are affected; patched version 4.8.8 is available.
The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local file inclusion in the WP Maps (flippercode) plugin for WordPress, affecting all versions up to and including 4.9.8, allows an authenticated attacker holding subscriber-level access or above to supply a crafted 'page' parameter that reaches the plugin's include logic and pulls in arbitrary local PHP files. File disclosure and access-control bypass are achievable against default configurations, but full remote code execution is conditional, requiring the attacker to additionally place or reference an includable .php file on the server (for example through an upload feature). There is no public exploit identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV).
Remote unauthenticated privilege escalation in the WP Maps Pro WordPress plugin (all versions through 6.1.0) allows attackers to create a new administrator account and authenticate as that user, resulting in complete site takeover. The flaw stems from an AJAX handler exposed to unauthenticated users and protected only by a publicly-embedded nonce, making the access check ineffective. No public exploit identified at time of analysis, but the trivial nature of the bug (default-enabled handler, no authentication, magic login URL returned to the caller) makes weaponization straightforward once details circulate.
A time-based SQL injection vulnerability exists in the WP Maps - Store Locator plugin for WordPress through version 4.9.1, allowing unauthenticated attackers to extract sensitive database information via the insufficiently sanitized 'orderby' parameter. With a CVSS score of 7.5 (High), this vulnerability requires no privileges or user interaction and can be exploited remotely over the network. No KEV listing or EPSS data is provided, but the vulnerability has been publicly disclosed by Wordfence with technical details and code references available.
Stored cross-site scripting in the WordPress plugin WP Maps - Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings (wp-google-map-plugin) in all versions up to and including 4.9.8 allows authenticated attackers holding only subscriber-level access to inject arbitrary JavaScript through the shapes_values parameter, which is insufficiently sanitized on input and unescaped on output. The nominal fc-call-nonce protection is ineffective because that nonce is exposed to every frontend visitor via window.wpgmp_local.nonce on map pages, and the drawing handler's secondary _wpnonce check can be bypassed simply by omitting the _wpnonce parameter from the request. Execution is deferred: the injected script fires when a victim (for example an administrator or any site visitor) later views the page containing the stored shape, and no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Stored Cross-Site Scripting in WP Maps (all versions through 4.9.4) allows authenticated attackers holding the wpgmp_manage_location capability - granted to administrators by default but delegable to lower-privileged roles - to inject persistent malicious scripts via the 'location_messages' parameter. The CVSS scope change (S:C) confirms the injected payload executes across victim browser sessions on any page rendering the affected shortcode, enabling session hijacking or unauthorized actions on behalf of site visitors. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV; however, the delegable capability expands the potential attacker pool beyond pure administrators.
Stored XSS in WP Maps plugin for WordPress allows authenticated contributors to inject malicious scripts via the 'put_wpgm' shortcode due to insufficient input sanitization and output escaping. Attackers with contributor-level access and above can craft malicious shortcode attributes that persist in page content and execute for all subsequent visitors. All versions up to 4.8.7 are affected; patched version 4.8.8 is available.
The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.