Ultimate Maps by Supsystic vulnerabilities

The Ultimate Maps by Supsystic plugin versions 1.5.5 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

Unauthenticated PHP Object Injection vulnerability in Ultimate Maps by Supsystic plugin versions before 1.5.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.

Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.

Unauthenticated Broken Access Control vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.