CVE-2023-2526

The Easy Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.7. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to executes AJAX actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-31269 appears to be a duplicate of this issue.

• CWE-352

• https://plugins.trac.wordpress.org/browser/google-maps-easy/trunk/classes/frame.php?rev=2777743#L246Patch
• https://plugins.trac.wordpress.org/changeset/2916430/Patch
• https://plugins.trac.wordpress.org/changeset/2916430/google-maps-easy/trunk/classes/frame.php?contextall=1Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea4ca00-185b-4f5d-9c5c-f81ba4edad05?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/google-maps-easy/trunk/classes/frame.php?rev=2777743#L246Patch
• https://plugins.trac.wordpress.org/changeset/2916430/Patch
• https://plugins.trac.wordpress.org/changeset/2916430/google-maps-easy/trunk/classes/frame.php?contextall=1Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea4ca00-185b-4f5d-9c5c-f81ba4edad05?source=cveThird Party Advisory

Published

Jun 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25233Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow …9.8
• CVE-2023-25234Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow …9.8
• CVE-2023-25235Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow …7.5
• CVE-2023-2524A vulnerability classified as critical has been found in Con…9.8
• CVE-2023-25240An improper SameSite Attribute vulnerability in pimCore v10.…8.8
• CVE-2023-25241bgERP v22.31 was discovered to contain a reflected cross-sit…6.1
• CVE-2023-25260Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local Fi…7.5
• CVE-2023-25261Certain Stimulsoft GmbH products are affected by: Remote Cod…9.8
• CVE-2023-25262Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulner…7.5
• CVE-2023-25263In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, onc…5.5
• CVE-2023-25264An issue was discovered in Docmosis Tornado prior to version…7.5
• CVE-2023-25265Docmosis Tornado <= 2.9.4 is vulnerable to Directory Travers…7.5