Vulnerabilities

TI-2026-82329 CVE-2026-107743 · GHSA-4r6v-cgvq-4mgw

Unauthenticated stored cross-site scripting in Mapster WP Maps

LOW 32

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00401 Published 2026-10-29 No fix listed CWE-79

TI-2026-67933 CVE-2026-39720 · GHSA-3c23-3582-jh63

Cross-site scripting in Mapster WP Maps WordPress plugin

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0023 Published 2026-10-06 No fix listed CWE-79

TI-2026-11023 CVE-2026-12954 · GHSA-gxqq-92xq-fjh7

Improper input validation in Mapster WP Maps

MEDIUM 41

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the `my_profile_update()` function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00648 Published 2026-09-18 No fix listed CWE-20

TI-2024-12404 CVE-2024-13362 · GHSA-c7cj-88jr-mhx2

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

LOW 27

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00276 Published 2026-05-01 No fix listed CWE-79

TI-2025-08288 CVE-2025-9044 · GHSA-ghjc-mqcr-m429

Mapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00262 Published 2025-09-26 No fix listed CWE-79

TI-2024-09814 CVE-2024-10592 · GHSA-4q5h-c56v-vfvm

Mapster WP Maps <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 30

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup class parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00816 Published 2024-11-16 No fix listed CWE-80

TI-2024-08571 CVE-2024-9235 · GHSA-hxm9-74vc-277m

Mapster WP Maps <= 1.5.0 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Options Update

MEDIUM 41

The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to an insufficient capability check on the mapster_wp_maps_set_option_from_js() functi…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.005 Published 2024-10-25 No fix listed CWE-285

TI-2024-14430 CVE-2024-21744 · GHSA-f2w2-g9x5-9598

WordPress Mapster WP Maps Plugin <= 1.2.38 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mapster Technology Inc.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00328 Published 2024-01-08 No fix listed CWE-79

Vulnerabilities

Filters