CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2025-2055 – MapPress Maps for WordPress < 2.94.9 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2025-2055
03 Apr 2025 — The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks. • https://wpscan.com/vulnerability/a8bfdbbf-6963-4fab-826a-6be770ac72c3 •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-0420 – MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-0420
17 Jan 2024 — The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks El complemento MapPress Maps para WordPress anterior a 2.88.15 no sanitiza ni escapa el título del mapa cuando lo muestra nuevamente en el panel de administración, lo que permite a los colaboradores y roles superiores realizar ataques de Cross-Site Scripting Almacenado. The MapPres... • https://wpscan.com/vulnerability/b6187ef8-70f4-4911-abd7-42bf6b7e54b7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2024-0421 – MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure
https://notcve.org/view.php?id=CVE-2024-0421
17 Jan 2024 — The MapPress Maps for WordPress plugin before 2.88.16 does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts. El complemento MapPress Maps para WordPress anterior a 2.88.16 no garantiza que las publicaciones que se recuperarán mediante una acción AJAX sean un mapa público, lo que permite a usuarios no autenticados leer publicaciones arbitrarias privadas y borradores. The MapPress Maps for WordPress plugin before ... • https://wpscan.com/vulnerability/587acc47-1966-4baf-a380-6aa479a97c82 • CWE-862: Missing Authorization •