MapPressPro MapPress any version

WordPress MapPress Maps for WordPress Plugin <= 2.85.4 is vulnerable to SQL Injection

The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leading to remote code execution.

The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files, leading to Remote Code Execution. NOTE: this issue exists because of an incomplete fix for CVE-2020-12077.

MapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code Execution

MapPress Maps for WordPress < 2.94.9 - Contributor+ Stored XSS

MapPress Maps for WordPress <= 2.88.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

MapPress Maps for WordPress <= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

MapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings

MapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block

MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scripting

MapPress Maps for WordPress < 2.94.10 - Admin+ Stored XSS

MapPress Maps for WordPress < 2.93 - Admin+ Stored XSS via Map Settings