Skip to content
Sign in
3.5 Low

CVE-2025-3504 The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high…

Description

The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected products and versions

Product Affected versions Fixed in
WP Maps 4.7 earliest → < 4.7.2 4.7.2

Other CVEs of WP Maps

The 7 CVEs of WP Maps →
CVE-2026-18466 The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX… 5.4 Medium CVE-2026-16265 The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not… 6.5 Medium CVE-2026-16263 The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not… 8.8 High CVE-2026-6381 The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path,… 7.5 High
Track this CVE