CVE-2026-56011
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The vulnerability allows an unauthenticated attacker to execute XSS scripts in the MapPress Maps plugin for WordPress versions up to and including 2.97.3.
Risk Assessment
An attacker can inject malicious JavaScript code, leading to session theft, redirects, or website defacement without requiring authentication.
Recommendation
Immediately update the MapPress Maps plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in MapPress Maps for WordPress <= 2.97.3
See all- CVE-2026-65564Medium
The MapPress Maps for WordPress plugin version 2.97.6 and earlier exposes sensitive data without authentication. An unauthenticated attacker can access confidential information.
- CVE-2026-8839Medium
The MapPress Maps plugin for WordPress up to version 2.96.6 has an authorization bypass in the REST API. Missing ownership verification allows unauthenticated attackers to read map data (titles, addresses, coordinates, body content) and authenticated attackers (Contributor and above) to modify, delete, or clone any map.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions.