GCVE - cpe:2.3:a:unknown:wp_maps:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:wp_maps:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Wp Maps (`f22f5155-ed65-5dab-a9a1-4c34493a1be9`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-16265`	vulnerable	2026-09-16 04:32:56.922332	WP Maps < 4.9.7 - Subscriber+ Denial of Service The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service. Published: 2026-08-07T06:00:14.361Z Updated: 2026-08-07T18:19:05.614Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/5432f989-03d8-49d9-ac45-0d5a6a7bf499/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-16263`	vulnerable	2026-09-16 04:32:56.648649	WP Maps < 4.9.7 - Subscriber+ Local File Inclusion The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server. Published: 2026-08-07T06:00:14.183Z Updated: 2026-08-07T18:18:21.709Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/015d7f26-81f2-4b15-b52e-3d28d68eb5bd/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-6381`	vulnerable	2026-06-08 08:07:04.719193	WP Maps < 4.9.3 - Subscriber+ Local File Inclusion The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks. Published: 2026-05-18T06:00:08.784Z Updated: 2026-05-18T13:37:39.129Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/18b36672-58d7-44fa-b653-b728e9ef257a/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-3504`	vulnerable	2026-06-08 07:23:09.007826	WP Maps < 4.7.2 - Admin+ Stored XSS The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Published: 2025-05-01T06:00:04.597Z Updated: 2025-05-01T14:47:54.188Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/252484a6-96f0-43f3-a7dc-d20cc89ba119/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-3503`	vulnerable	2026-06-08 07:23:09.007484	WP Maps < 4.7.2 - Admin+ Stored XSS The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Published: 2025-05-01T06:00:04.224Z Updated: 2025-05-02T15:29:12.390Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/83ddd432-309f-4ff5-974c-fdc9c67d1051/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-3502`	vulnerable	2026-06-08 07:23:09.006332	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.