mapster CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH mapster CVE published 2026-09-18

CVE-2026-12954

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0. This vulnerability allows authenticated attackers with Subscriber-level access and above to update arbitrary user meta values. The vulnerability exists due to insufficient validation and sanitization of user-supplied input in the `my_profile_update()` function, which fails to p [truncated]