CVE-2021-25081CWE-352

CVE-2021-25081: vulnerability in Maps Plugin using Google Maps for WordPress…

WP Google Map < 1.8.4 - Arbitrary Post Deletion and Plugin's Settings Update via CSRF

Published · Updated

Follow this CVE+ Monitor Maps Plugin using Google Maps for WordPress – WP Google Map

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.6%
The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make logged in admins delete arbitrary posts and update the plugin's settings via a CSRF attack
Affected products
Unknown · Maps Plugin using Google Maps for WordPress – WP Google Map
Related CVEs — Maps Plugin using Google Maps for WordPress…

In the same product, most dangerous first.

CVE-2021-24502—WP Google Map < 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2021-25011—WP Google Map < 1.8.1 - Subscriber+ Arbitrary Post Deletion and Plugin's Settings UpdateEPSS 0.4%