CVE-2026-13456

Published 25 September 2026 · tracked since 25 September 2026

Description

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with subscriber-leve

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-119303 MEDIUM 5.3
• CVE-2026-119035 MEDIUM 6.4
• CVE-2026-119034 MEDIUM 5.3
• CVE-2026-119032 MEDIUM 5.3
• CVE-2026-118439 MEDIUM 4.1
• CVE-2026-118420 MEDIUM 6.8
• CVE-2026-118418 MEDIUM 5.3
• CVE-2026-118041 HIGH 8.8
• CVE-2026-117523 MEDIUM 4.3
• CVE-2026-117522 MEDIUM 6.8

→ Open the live CVE board · all tools