MapPress Maps for WordPress vulnerabilities

The MapPress Maps for WordPress plugin version 2.97.6 and earlier exposes sensitive data without authentication. An unauthenticated attacker can access confidential information.

The vulnerability allows an unauthenticated attacker to execute XSS scripts in the MapPress Maps plugin for WordPress versions up to and including 2.97.3.

The MapPress Maps plugin for WordPress up to version 2.96.6 has an authorization bypass in the REST API. Missing ownership verification allows unauthenticated attackers to read map data (titles, addresses, coordinates, body content) and authenticated attackers (Contributor and above) to modify, delete, or clone any map.