cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2024-10715,https://securityvulnerability.io/vulnerability/CVE-2024-10715,Stored Cross-Site Scripting Vulnerability in MapPress Maps for WordPress Plugin,"The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map block in all versions up to, and including, 2.94.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",Wordpress,Mappress,5.4,MEDIUM,0.00044999999227002263,false,,false,false,false,,false,false,2024-11-06T11:15:00.000Z,0
CVE-2024-0420,https://securityvulnerability.io/vulnerability/CVE-2024-0420,Stored Cross-Site Scripting Vulnerability in MapPress Maps for WordPress Plugin,"The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks",Wordpress,Mappress Maps For WordPress,5.4,MEDIUM,0.0005099999834783375,false,,false,false,true,true,false,false,2024-02-12T16:05:58.767Z,0
CVE-2024-0421,https://securityvulnerability.io/vulnerability/CVE-2024-0421,Unauthenticated Access to Private and Draft Posts via AJAX,"The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts.",Wordpress,Mappress Maps For WordPress,5.3,MEDIUM,0.0005300000193528831,false,,false,false,true,true,false,false,2024-02-12T16:05:57.729Z,0
CVE-2023-7225,https://securityvulnerability.io/vulnerability/CVE-2023-7225,Stored Cross-Site Scripting Vulnerability in MapPress Maps for WordPress Plugin,"The MapPress Maps for WordPress plugin is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping within the width and height parameters. This vulnerability allows authenticated attackers with contributor access and higher privileges to inject arbitrary scripts into pages. These scripts can execute whenever a user accesses the manipulated page, potentially leading to unauthorized actions or data exposure.",Wordpress,MapPress Maps for WordPress,5.4,MEDIUM,0.0005699999746866524,false,,false,false,false,,false,false,2024-01-30T07:34:38.783Z,0
CVE-2023-6524,https://securityvulnerability.io/vulnerability/CVE-2023-6524,Stored Cross-Site Scripting Vulnerability in MapPress Maps for WordPress,"The MapPress Maps for WordPress plugin is susceptible to Stored Cross-Site Scripting through inadequate sanitization and escaping of the map title parameter. This vulnerability affects all versions up to and including 2.88.13. Authenticated users with contributor access or higher can exploit this weakness by injecting malicious scripts, leading to execution whenever a user interacts with an affected page, posing significant risks to website integrity and user safety.",Wordpress,MapPress Maps for WordPress,5.4,MEDIUM,0.0006000000284984708,false,,false,false,false,,false,false,2024-01-03T06:15:00.000Z,0
CVE-2023-26015,https://securityvulnerability.io/vulnerability/CVE-2023-26015,WordPress MapPress Maps for WordPress Plugin <= 2.85.4 is vulnerable to SQL Injection,"The MapPress Maps for WordPress plugin is susceptible to an SQL Injection vulnerability that allows an attacker to manipulate SQL queries by injecting malicious code. This flaw affects versions up to 2.85.4 and could potentially lead to unauthorized access to sensitive data within the database, compromising the integrity and confidentiality of the application. Users of MapPress Maps for WordPress should take immediate action to mitigate this issue by upgrading to the latest version and securing their installations.",Wordpress,MapPress Maps for WordPress,9.8,CRITICAL,0.0013800000306218863,false,,false,false,false,,false,false,2023-11-03T13:15:00.000Z,0
CVE-2023-4840,https://securityvulnerability.io/vulnerability/CVE-2023-4840,Stored Cross-Site Scripting Vulnerability in MapPress Maps for WordPress,"The MapPress Maps for WordPress plugin is vulnerable to Stored Cross-Site Scripting due to inadequate sanitization and escaping of user inputs via the 'mappress' shortcode. Authenticated attackers with contributor-level or higher permissions can exploit this vulnerability to inject malicious web scripts into pages. These scripts can be executed when other users access the compromised pages, potentially leading to unauthorized actions or data exposure.",Wordpress,MapPress Maps for WordPress,5.4,MEDIUM,0.0005799999926239252,false,,false,false,false,,false,false,2023-09-12T02:15:00.000Z,0
CVE-2022-0537,https://securityvulnerability.io/vulnerability/CVE-2022-0537,MapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code Execution,"The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the ""ajax_save"" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.",Wordpress,MapPress Maps for WordPress,7.2,HIGH,0.0013899999903514981,false,,false,false,false,,false,false,2022-04-04T15:35:46.000Z,0
CVE-2022-0208,https://securityvulnerability.io/vulnerability/CVE-2022-0208,MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scripting,"The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the ""Bad mapid"" error message, leading to a Reflected Cross-Site Scripting",Wordpress,Mappress Maps For WordPress,6.1,MEDIUM,0.0011699999449774623,false,,false,false,false,,false,false,2022-02-14T09:21:07.000Z,0
CVE-2020-12675,https://securityvulnerability.io/vulnerability/CVE-2020-12675,,"The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files, leading to Remote Code Execution. NOTE: this issue exists because of an incomplete fix for CVE-2020-12077.",Wordpress,Mappress,8.8,HIGH,0.0030799999367445707,false,,false,false,false,,false,false,2020-05-29T15:52:06.000Z,0
CVE-2020-12077,https://securityvulnerability.io/vulnerability/CVE-2020-12077,,"The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leading to remote code execution.",Wordpress,Mappress,8.8,HIGH,0.006940000224858522,false,,false,false,true,true,false,false,2020-04-23T02:20:46.000Z,0