CVE-2026-39720 Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions

Description

Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

Affected products and versions

Product	Affected versions	Fixed in
Mapster WP Maps 2.0	earliest → 2.0.4	No fix stated

Other CVEs of Mapster WP Maps

The 7 CVEs of Mapster WP Maps →

CVE-2026-107743 The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and… 7.2 High CVE-2026-12954 The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and… 8.8 High CVE-2024-13362 Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in… 6.1 Medium CVE-2025-9044 The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up… 6.4 Medium