Plugin icon

MapPress Maps for WordPress

mappress-google-maps-for-wordpress

Vulnerabilities:

15

Last Updated:

March 20, 2026

Active Installs:

30000

Published
Title
Fixed in
CVSS
Published
2025-03-27
Title
MapPress Maps for WordPress < 2.94.10 - Admin+ Stored XSS
Fixed in
Fixed in 2.94.10
CVSS
3.5 (low)
Published
2025-03-13
Title
MapPress Maps for WordPress < 2.94.9 - Contributor+ Stored XSS
Fixed in
Fixed in 2.94.9
CVSS
6.8 (medium)
Published
2024-11-05
Title
MapPress Maps for WordPress < 2.94.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block
Fixed in
Fixed in 2.94.2
CVSS
6.4 (medium)
Published
2024-08-01
Title
MapPress Maps for WordPress < 2.93 - Admin+ Stored XSS via Map Settings
Fixed in
Fixed in 2.93
CVSS
3.5 (low)
Published
2024-01-29
Title
MapPress < 2.88.17 - Contributor+ Stored XSS via Map Settings
Fixed in
Fixed in 2.88.17
CVSS
5.9 (medium)
Published
2024-01-17
Title
MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure
Fixed in
Fixed in 2.88.16
CVSS
5.3 (medium)
Published
2024-01-17
Title
MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSS
Fixed in
Fixed in 2.88.15
CVSS
5.9 (medium)
Published
2024-01-02
Title
MapPress Maps for WordPress < 2.88.14 - Contributor+ Stored XSS
Fixed in
Fixed in 2.88.14
CVSS
5.9 (medium)
Published
2023-09-11
Title
MapPress Maps for WordPress < 2.88.5 - Contributor+ Stored XSS
Fixed in
Fixed in 2.88.5
CVSS
6.8 (medium)
Published
2023-04-06
Title
MapPress Maps for WordPress < 2.85.5 - Contributor+ SQL Injection
Fixed in
Fixed in 2.85.5
CVSS
6.8 (medium)
Published
2022-03-14
Title
MapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code Execution
Fixed in
Fixed in 2.73.13
CVSS
6.6 (medium)
Published
2022-01-17
Title
MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scripting
Fixed in
Fixed in 2.73.4
CVSS
6.1 (medium)
Published
2020-05-28
Title
MapPress Maps < 2.54.6 - Improper Capability Checks in AJAX Calls
Fixed in
Fixed in 2.54.6
CVSS
9.9 (critical)
Published
2020-04-23
Title
MapPress Maps < 2.53.9 - Authenticated Map Creation/Deletion Leading to Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.53.9
CVSS
6.5 (medium)
Published
2020-04-23
Title
MapPress Maps Pro < 2.53.9 - Remote Code Execution (RCE) due to Incorrect Access Control in AJAX Actions
Fixed in
Fixed in 2.53.9
CVSS
9.9 (critical)