Unknown Wp Maps vulnerabilities

4 CVEs affecting Unknown Wp Maps, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-18466, published 2026-08-19.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-16263, published 2026-08-07. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion,…
• CVE-2026-6381, published 2026-05-18. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks.
• CVE-2026-16265, published 2026-08-07. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account…
• CVE-2026-18466, published 2026-08-19. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited…