Wp Maps
Monthly
SQL injection in the WP Maps WordPress plugin (Flipper Code) through version 4.9.9 lets an attacker who already holds a WordPress Administrator session inject arbitrary SQL through an admin-side parameter, exposing database contents. The vulnerable code path is administrator-only (CVSS PR:H), so the flaw cannot be triggered by unauthenticated or low-privilege users, and no public exploit code has been identified at time of analysis; reported by Patchstack (ENISA EUVD-2026-81504). This is a high-CVSS (7.6) but comparatively low real-world-priority issue once the highest-privilege prerequisite is weighed.
Local file inclusion via path traversal in WP Maps WordPress plugin (before 4.9.7) allows any authenticated Subscriber-level user to include and execute arbitrary existing PHP files on the server, resulting in full compromise of confidentiality, integrity, and availability. The root cause is a missing capability check on an AJAX action combined with unvalidated user-controlled path input - two compounding weaknesses that collectively drop the privilege bar to the lowest registered-user tier. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation activity at time of analysis despite the public POC.
Unauthenticated SQL injection in the WP Maps WordPress plugin (versions 4.9.1 and earlier, by Flipper Code) allows remote attackers to inject arbitrary SQL queries against the underlying WordPress database without any authentication or user interaction. With a CVSS 3.1 score of 9.3 and a scope-changed vector, successful exploitation can disclose sensitive database contents (users, hashed credentials, secrets) and affect availability. No public exploit identified at time of analysis, but the unauthenticated nature and trivial complexity make weaponization likely once technical details circulate.
Local File Inclusion in the WP Maps WordPress plugin before 4.9.3 allows authenticated users to read arbitrary files by injecting path traversal sequences into an unsanitized parameter used to build a file path. Publicly available exploit code exists (reported by WPScan), though EPSS is low (0.03%, 8th percentile) and the flaw is not automatable per SSVC. A vendor patch is available in version 4.9.3.
Denial of Service in the WP Maps WordPress plugin before 4.9.7 allows any authenticated subscriber to exhaust server resources by exploiting a missing capability check in an AJAX action handler. The flaw, discovered and reported by WPScan, permits a low-privileged user to invoke an unrestricted operation that triggers uncontrolled recursion, potentially rendering the affected WordPress site unavailable. A publicly available proof-of-concept exists, though EPSS remains low (0.14%) and CISA has not listed this in KEV, suggesting exploitation is currently opportunistic rather than widespread.
Sensitive data exposure in the WP Maps WordPress plugin (versions through 4.9.6) allows authenticated low-privilege users to retrieve embedded sensitive information - likely including API keys such as Google Maps API credentials - from data returned by the plugin. Exploitation requires a valid WordPress account with minimal permissions (CVSS PR:L), making it accessible to any registered user on an affected site. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector lowers the bar for opportunistic discovery.
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps - WP MAPS (formerly WP Google Map Plugin) plugin <= 4.4.2 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the page, leading to a Stored Cross-Site Scripting issue by high privilege users,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the WP Maps WordPress plugin (Flipper Code) through version 4.9.9 lets an attacker who already holds a WordPress Administrator session inject arbitrary SQL through an admin-side parameter, exposing database contents. The vulnerable code path is administrator-only (CVSS PR:H), so the flaw cannot be triggered by unauthenticated or low-privilege users, and no public exploit code has been identified at time of analysis; reported by Patchstack (ENISA EUVD-2026-81504). This is a high-CVSS (7.6) but comparatively low real-world-priority issue once the highest-privilege prerequisite is weighed.
Local file inclusion via path traversal in WP Maps WordPress plugin (before 4.9.7) allows any authenticated Subscriber-level user to include and execute arbitrary existing PHP files on the server, resulting in full compromise of confidentiality, integrity, and availability. The root cause is a missing capability check on an AJAX action combined with unvalidated user-controlled path input - two compounding weaknesses that collectively drop the privilege bar to the lowest registered-user tier. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation activity at time of analysis despite the public POC.
Unauthenticated SQL injection in the WP Maps WordPress plugin (versions 4.9.1 and earlier, by Flipper Code) allows remote attackers to inject arbitrary SQL queries against the underlying WordPress database without any authentication or user interaction. With a CVSS 3.1 score of 9.3 and a scope-changed vector, successful exploitation can disclose sensitive database contents (users, hashed credentials, secrets) and affect availability. No public exploit identified at time of analysis, but the unauthenticated nature and trivial complexity make weaponization likely once technical details circulate.
Local File Inclusion in the WP Maps WordPress plugin before 4.9.3 allows authenticated users to read arbitrary files by injecting path traversal sequences into an unsanitized parameter used to build a file path. Publicly available exploit code exists (reported by WPScan), though EPSS is low (0.03%, 8th percentile) and the flaw is not automatable per SSVC. A vendor patch is available in version 4.9.3.
Denial of Service in the WP Maps WordPress plugin before 4.9.7 allows any authenticated subscriber to exhaust server resources by exploiting a missing capability check in an AJAX action handler. The flaw, discovered and reported by WPScan, permits a low-privileged user to invoke an unrestricted operation that triggers uncontrolled recursion, potentially rendering the affected WordPress site unavailable. A publicly available proof-of-concept exists, though EPSS remains low (0.14%) and CISA has not listed this in KEV, suggesting exploitation is currently opportunistic rather than widespread.
Sensitive data exposure in the WP Maps WordPress plugin (versions through 4.9.6) allows authenticated low-privilege users to retrieve embedded sensitive information - likely including API keys such as Google Maps API credentials - from data returned by the plugin. Exploitation requires a valid WordPress account with minimal permissions (CVSS PR:L), making it accessible to any registered user on an affected site. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector lowers the bar for opportunistic discovery.
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps - WP MAPS (formerly WP Google Map Plugin) plugin <= 4.4.2 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the page, leading to a Stored Cross-Site Scripting issue by high privilege users,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.