Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
250 results · page 3 of 5
May 16, 2025MapSVG: Missing AuthorizationCVE-2025-47560 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through < 8.6.13.
- Product
- MapSVG
- What to do
- Update MapSVG to the newest version.
May 16, 2025MapSVG: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47557 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg allows Stored XSS.This issue affects MapSVG: from n/a through <= 8.5.31.
- Product
- MapSVG
- Affected
- up to 8.5.31
- What to do
- Affects up to 8.5.31. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025MapPress Maps for: Does not sanitise and escape some of its settingsCVE-2024-8620 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- MapPress Maps for
- Fixed in
- 2.93
- What to do
- Update MapPress Maps for to 2.93 or newer.
May 1, 2025GmapsMania: Stored Cross-Site ScriptingCVE-2025-4131 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GmapsMania plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gmap shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GmapsMania
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update GmapsMania to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3504 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Maps
- Fixed in
- 4.7.2
- What to do
- Update WP Maps to 4.7.2 or newer.
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3503 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Maps
- Fixed in
- 4.7.2
- What to do
- Update WP Maps to 4.7.2 or newer.
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3502 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Maps
- Fixed in
- 4.7.2
- What to do
- Update WP Maps to 4.7.2 or newer.
Apr 18, 2025MapPress Maps for: Does not sanitise and escape some of its settingsCVE-2025-2162 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- MapPress Maps for
- Fixed in
- 2.94.10
- What to do
- Update MapPress Maps for to 2.94.10 or newer.
Apr 17, 2025Simple Maps: Cross-Site Request Forgery (CSRF)CVE-2025-39424 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in simplemaps Simple Maps interactive-maps allows Stored XSS.This issue affects Simple Maps: from n/a through <= 0.98.
- Product
- Simple Maps
- Affected
- up to 0.98
- What to do
- Affects up to 0.98. Update Simple Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025MapSVG: Unrestricted Upload of File with Dangerous TypeCVE-2025-32682 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through <= 8.6.4.
- Product
- MapSVG
- Affected
- up to 8.6.4
- What to do
- Affects up to 8.6.4. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Google Maps GPX Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27313 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bernd Altmeier Google Maps GPX Viewer google-maps-gpx-viewer allows Reflected XSS.This issue affects Google Maps GPX Viewer: from n/a through <= 3.6.
- Product
- Google Maps GPX Viewer
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update Google Maps GPX Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Interactive Geo Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32525 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MapGeo Interactive Geo Maps interactive-geo-maps allows Reflected XSS.This issue affects Interactive Geo Maps: from n/a through <= 1.6.24.
- Product
- Interactive Geo Maps
- Affected
- up to 1.6.24
- What to do
- Affects up to 1.6.24. Update Interactive Geo Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025MapSVG: Missing AuthorizationCVE-2025-32684 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through <= 8.6.4.
- Product
- MapSVG
- Affected
- up to 8.6.4
- What to do
- Affects up to 8.6.4. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025MapSVG: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32683 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows DOM-Based XSS.This issue affects MapSVG: from n/a through <= 8.6.6.
- Product
- MapSVG
- Affected
- up to 8.6.6
- What to do
- Affects up to 8.6.6. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Maps for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32179 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc Maps for WP maps-for-wp allows Stored XSS.This issue affects Maps for WP: from n/a through <= 1.2.4.
- Product
- Maps for WP
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Maps for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025YaMaps for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32172 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yuri Baranov YaMaps for WordPress yamaps allows Stored XSS.This issue affects YaMaps for WordPress: from n/a through <= 0.6.40.
- Product
- YaMaps for
- Affected
- up to 0.6.40
- What to do
- Affects up to 0.6.40. Update YaMaps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Easy Google Maps: Improper Restriction of XML External Entity ReferenceCVE-2025-32138 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Restriction of XML External Entity Reference vulnerability in supsystic Easy Google Maps google-maps-easy allows XML Injection.This issue affects Easy Google Maps: from n/a through <= 1.11.18.
- Product
- Easy Google Maps
- Affected
- up to 1.11.18
- What to do
- Affects up to 1.11.18. Update Easy Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Maps: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-2279 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Maps WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Maps
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025MapPress Maps for: Does not sanitise and escape some parametersCVE-2025-2055 · WordPress plugins & themes · reported by WPScanMedium 6.8
The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- MapPress Maps for
- Fixed in
- 2.94.9
- What to do
- Update MapPress Maps for to 2.94.9 or newer.
Mar 26, 2025Arrow Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28858 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Maps ap-google-maps allows Reflected XSS.This issue affects Arrow Maps: from n/a through <= 1.0.9.
- Product
- Arrow Maps
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Arrow Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2025Hero Maps Premium: SQL InjectionCVE-2024-13781 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Hero Maps Premium plugin for WordPress is vulnerable to SQL Injection via several AJAX actions in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Hero Maps Premium
- Affected
- up to 2.3.9
- What to do
- Affects up to 2.3.9. Update Hero Maps Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Mar 3, 2025AcuGIS Leaflet Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27278 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Ghedini AcuGIS Leaflet Maps mapfig-premium-leaflet-map-maker allows Reflected XSS.This issue affects AcuGIS Leaflet Maps: from n/a through <= 5.1.1.0.
- Product
- AcuGIS Leaflet Maps
- Affected
- up to 5.1.1.0
- What to do
- Affects up to 5.1.1.0. Update AcuGIS Leaflet Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Google Maps for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27265 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aaron D. Campbell Google Maps for WordPress google-maps-for-wordpress allows DOM-Based XSS.This issue affects Google Maps for WordPress: from n/a through <= 1.0.3.
- Product
- Google Maps for
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Google Maps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2025Maps for WP: Stored Cross-Site ScriptingCVE-2024-13648 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Maps for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Maps for WP
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Maps for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 15, 2025Maps Plugin using Google Maps for WordPress: Does not sanitise and escape some of its settingsCVE-2024-13306 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Maps Plugin using Google Maps for WordPress
- Fixed in
- 1.9.4
- What to do
- Update Maps Plugin using Google Maps for WordPress to 1.9.4 or newer.
Feb 15, 2025Maps Plugin using Google Maps for WordPress: Does not sanitise and escape some of its settingsCVE-2024-13208 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Maps Plugin using Google Maps for WordPress
- Fixed in
- 1.9.4
- What to do
- Update Maps Plugin using Google Maps for WordPress to 1.9.4 or newer.
Jan 27, 2025WP Go Maps: Cross-Site Request Forgery (CSRF)CVE-2025-24742 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPGMaps WP Go Maps wp-google-maps.This issue affects WP Go Maps: from n/a through <= 9.0.40.
- Product
- WP Go Maps
- Affected
- up to 9.0.40
- What to do
- Affects up to 9.0.40. Update WP Go Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WP Google Street View (with 360° virtual tour) & Google maps + Local SEO: Stored Cross-Site ScriptingCVE-2024-13542 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgsv' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Google Street View (with 360° virtual tour) & Google maps + Local SEO
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update WP Google Street View (with 360° virtual tour) & Google maps + Local SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 16, 2025Magic Google Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23935 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fengler Magic Google Maps magic-google-maps allows Stored XSS.This issue affects Magic Google Maps: from n/a through <= 1.0.4.
- Product
- Magic Google Maps
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Magic Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025LSD Google Maps Embedder: Cross-Site Request Forgery (CSRF)CVE-2025-23871 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Bas Matthee LSD Google Maps Embedder lsd-google-maps-embedder allows Cross Site Request Forgery.This issue affects LSD Google Maps Embedder: from n/a through <= 1.1.
- Product
- LSD Google Maps Embedder
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update LSD Google Maps Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025wp_amaps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23794 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _rccoder_ wp_amaps wp-amaps allows Stored XSS.This issue affects wp_amaps: from n/a through <= 1.7.
- Product
- wp_amaps
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update wp_amaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025GMAPS for WPBakery Page Builder Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23775 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WWP GMAPS for WPBakery Page Builder Free gmaps-for-visual-composer-free allows Stored XSS.This issue affects GMAPS for WPBakery Page Builder Free: from n/a through <= 1.2.
- Product
- GMAPS for WPBakery Page Builder Free
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update GMAPS for WPBakery Page Builder Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025RSV GMaps: Cross-Site Request Forgery (CSRF)CVE-2025-23665 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ravi Kumar Vanukuru RSV GMaps rsv-google-maps allows Stored XSS.This issue affects RSV GMaps: from n/a through <= 1.5.
- Product
- RSV GMaps
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update RSV GMaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025Free Google Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22329 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agile Logix Free Google Maps wp-map allows Stored XSS.This issue affects Free Google Maps: from n/a through <= 1.0.1.
- Product
- Free Google Maps
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Free Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Google Maps Travel Route: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22537 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in traveller11 Google Maps Travel Route google-maps-travel-route allows SQL Injection.This issue affects Google Maps Travel Route: from n/a through <= 1.3.1.
- Product
- Google Maps Travel Route
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Google Maps Travel Route to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Mind Doodle Visual Sitemaps & Tasks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22544 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mind Doodle Mind Doodle Visual Sitemaps & Tasks mind-doodle-sitemap allows Stored XSS.This issue affects Mind Doodle Visual Sitemaps & Tasks: from n/a through <= 1.6.
- Product
- Mind Doodle Visual Sitemaps & Tasks
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Mind Doodle Visual Sitemaps & Tasks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 202510Web Map Builder for Google Maps: Missing AuthorizationCVE-2023-45272 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in 10Web 10Web Map Builder for Google Maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10Web Map Builder for Google Maps: from n/a through 1.0.73.
- Product
- 10Web Map Builder for Google Maps
- Affected
- up to 1.0.73
- What to do
- Affects up to 1.0.73. Update 10Web Map Builder for Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Pronamic Google Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56240 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pronamic Pronamic Google Maps pronamic-google-maps allows Stored XSS.This issue affects Pronamic Google Maps: from n/a through <= 2.3.2.
- Product
- Pronamic Google Maps
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Pronamic Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 21, 2024Reactflow Visitor Recording and Heatmaps: Reflected Cross-Site ScriptingCVE-2024-11975 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Reactflow Visitor Recording and Heatmaps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Reactflow Visitor Recording and Heatmaps
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Reactflow Visitor Recording and Heatmaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 20, 2024Store Locator for WordPress with Google Maps – LotsOfLocales: Local File Inclusion in version 3CVE-2024-12571 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Store Locator for WordPress with Google Maps – LotsOfLocales plugin for WordPress is vulnerable to Local File Inclusion in version 3.98.9 via the 'sl_engine' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Store Locator for WordPress with Google Maps – LotsOfLocales
- What to do
- Update Store Locator for WordPress with Google Maps – LotsOfLocales to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 16, 2024Responsive Google Maps | by imbaa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56011 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ilja Zaglov Responsive Google Maps | by imbaa responsive-google-maps allows Stored XSS.This issue affects Responsive Google Maps | by imbaa: from n/a through <= 1.2.5.
- Product
- Responsive Google Maps | by imbaa
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Responsive Google Maps | by imbaa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024AppMaps: Cross-Site Request Forgery (CSRF)CVE-2024-54400 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in meloniq AppMaps appmaps allows Stored XSS.This issue affects AppMaps: from n/a through <= 1.1.
- Product
- AppMaps
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update AppMaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024The EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor plugin forCVE-2024-11203 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘provider_name parameter in all versions up to, and including, 4.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Smooth Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51901 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wojciechborowicz Smooth Maps colour-smooth-maps allows Stored XSS.This issue affects Smooth Maps: from n/a through <= 1.1.
- Product
- Smooth Maps
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Smooth Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024SimpleGMaps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52346 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JavierMendezPWG SimpleGMaps simplegmaps allows Stored XSS.This issue affects SimpleGMaps: from n/a through <= 1.0.
- Product
- SimpleGMaps
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update SimpleGMaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Mapster WP Maps: Stored Cross-Site ScriptingCVE-2024-10592 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup class parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Mapster WP Maps
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Mapster WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 8, 2024Simple Shortcode for Google Maps: Stored Cross-Site ScriptingCVE-2024-10621 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pw_map shortcode in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Simple Shortcode for Google Maps
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Simple Shortcode for Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 6, 2024MapPress Maps for: Stored Cross-Site ScriptingCVE-2024-10715 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map block in all versions up to, and including, 2.94.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MapPress Maps for
- Affected
- up to 2.94.1
- What to do
- Affects up to 2.94.1. Update MapPress Maps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 25, 2024Mapster WP Maps: Unauthorized modification of data that can lead to privilege escalationCVE-2024-9235 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to an insufficient capability check on the mapster_wp_maps_set_option_from_js() function in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with contributor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Mapster WP Maps
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Mapster WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 9, 2024QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages: Unauthorized modification of dataCVE-2024-8513 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_save_plugin_config() function in all versions up to, and including, 4.1.1.1. This makes it possible for unauthenticated attackers to update the plugin's settings.
- Product
- QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages
- Affected
- up to 4.1.1.1
- What to do
- Affects up to 4.1.1.1. Update QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.