Approved changes feed: RSS · Atom
cpe:2.3:a:mappresspro:mappress:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Mappresspro (2bd68376-8c88-5628-884f-556e319ac816) |
|---|---|
| Product | Mappress (2cb868b7-b787-584a-8392-71c566401681) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-7225 |
vulnerable | 2026-06-08 06:21:57.335836 |
MapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings
MEDIUM (6.4)
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all versions up to, and including, 2.88.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2024-01-30T07:34:38.783Z
Updated: 2026-04-08T17:34:52.481Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4840 |
vulnerable | 2026-06-08 06:16:14.711332 |
MapPress Maps for WordPress <= 2.88.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
MEDIUM (6.4)
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortcode in versions up to, and including, 2.88.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2023-09-12T01:52:13.337Z
Updated: 2026-04-08T17:20:28.554Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-26015 |
vulnerable | 2026-06-08 05:57:37.814216 |
WordPress MapPress Maps for WordPress Plugin <= 2.85.4 is vulnerable to SQL Injection
HIGH (7.1)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Chris Richardson MapPress Maps for WordPress mappress-google-maps-for-wordpress allows SQL Injection.This issue affects MapPress Maps for WordPress: from n/a through 2.85.4.
Published: 2023-11-03T12:40:00.660Z
Updated: 2026-04-28T16:08:12.099Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0537 |
vulnerable | 2026-06-08 05:39:10.242703 |
MapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code Execution
The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.
Published: 2022-04-04T15:35:46.000Z
Updated: 2024-08-02T23:32:46.208Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0208 |
vulnerable | 2026-06-08 05:39:09.493826 |
MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scripting
The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting
Published: 2022-02-14T09:21:07.000Z
Updated: 2024-08-02T23:18:42.553Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-12675 |
vulnerable | 2026-06-08 05:17:58.729346 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-12077 |
vulnerable | 2026-06-08 05:17:56.437204 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.