Ultimate Maps By Supsystic
Monthly
Reflected cross-site scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions through 1.5.5) lets remote, unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is socially engineered into clicking an attacker-crafted link. The flaw is an output-encoding failure of class CWE-79 rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the attacker needs no credentials, but a victim with an active session on an affected site must be lured to the malicious page, and the resulting script runs in that site's origin. Impact is bounded to the browser context - script execution, possible session/token theft or content manipulation on the affected site - and does not by itself grant server-side code execution; there is no public exploit identified at time of analysis and no CISA KEV record for this CVE.
Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenticated remote attackers to perform privileged administrative actions without any credentials. The flaw stems from missing authorization checks (CWE-862), meaning the plugin executes sensitive operations without validating the requester's identity or permission level. With a CVSS 3.1 score of 7.5 and an attack vector of network/no-privileges-required, exploitation is trivially achievable against any WordPress site running the affected plugin; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated PHP Object Injection in the Ultimate Maps by Supsystic WordPress plugin (all versions before 1.5.0) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, instantiating arbitrary PHP objects. If a usable POP (property-oriented programming) gadget chain is present in the plugin, WordPress core, or any other active plugin, this can escalate to remote code execution, file operations, or database compromise. Reported by Patchstack and assigned CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered in a victim's browser. The CVSS vector confirms a Changed scope (S:C), meaning injected scripts execute within the victim's browser security context rather than the plugin's own origin, enabling session hijacking or malicious redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack vector significantly lowers the exploitation barrier.
Unauthenticated attackers can exploit a broken access control flaw in the Ultimate Maps by Supsystic WordPress plugin through version 1.5.5, allowing network-reachable actions that should be restricted to authorized users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) indicates low confidentiality and integrity impact with no availability impact, and the provided intelligence contains no CISA KEV entry and no public exploit identified at time of analysis. Sites are affected only if the plugin is installed, active, and its vulnerable endpoint is reachable; the plugin's niche deployment and the lack of a documented privileged action limit, but do not eliminate, mass-exploitation risk.
Reflected cross-site scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions through 1.5.5) lets remote, unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is socially engineered into clicking an attacker-crafted link. The flaw is an output-encoding failure of class CWE-79 rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the attacker needs no credentials, but a victim with an active session on an affected site must be lured to the malicious page, and the resulting script runs in that site's origin. Impact is bounded to the browser context - script execution, possible session/token theft or content manipulation on the affected site - and does not by itself grant server-side code execution; there is no public exploit identified at time of analysis and no CISA KEV record for this CVE.
Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenticated remote attackers to perform privileged administrative actions without any credentials. The flaw stems from missing authorization checks (CWE-862), meaning the plugin executes sensitive operations without validating the requester's identity or permission level. With a CVSS 3.1 score of 7.5 and an attack vector of network/no-privileges-required, exploitation is trivially achievable against any WordPress site running the affected plugin; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated PHP Object Injection in the Ultimate Maps by Supsystic WordPress plugin (all versions before 1.5.0) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, instantiating arbitrary PHP objects. If a usable POP (property-oriented programming) gadget chain is present in the plugin, WordPress core, or any other active plugin, this can escalate to remote code execution, file operations, or database compromise. Reported by Patchstack and assigned CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered in a victim's browser. The CVSS vector confirms a Changed scope (S:C), meaning injected scripts execute within the victim's browser security context rather than the plugin's own origin, enabling session hijacking or malicious redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack vector significantly lowers the exploitation barrier.
Unauthenticated attackers can exploit a broken access control flaw in the Ultimate Maps by Supsystic WordPress plugin through version 1.5.5, allowing network-reachable actions that should be restricted to authorized users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) indicates low confidentiality and integrity impact with no availability impact, and the provided intelligence contains no CISA KEV entry and no public exploit identified at time of analysis. Sites are affected only if the plugin is installed, active, and its vulnerable endpoint is reachable; the plugin's niche deployment and the lack of a documented privileged action limit, but do not eliminate, mass-exploitation risk.