Mohammad Aghdasi

**Name of the Vulnerable Software and Affected Versions** WP MAPS PRO versions prior to 6.1.3 **Description** An issue exists where the plugin fails to perform a capability check in an AJAX action available to unauthenticated users. Because the operation it dispatches is not restricted, unauthenticated attackers can trigger uncontrolled recursion, which exhausts server resources and leads to a Denial of Service (DoS), a condition where a service is unavailable to its intended users. **Recommendations** Update WP MAPS PRO to version 6.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** WP Maps versions prior to 4.9.7 **Description** An issue exists where the plugin fails to perform a capability check in an AJAX action and does not restrict the dispatched operation. This allows users with a Subscriber account to trigger uncontrolled recursion, which exhausts server resources and leads to a Denial of Service (DoS), a condition where a service is unavailable to its intended users. **Recommendations** Update WP Maps to version 4.9.7 or later.

Name of the Vulnerable Software and Affected Versions Export All URLs WordPress plugin versions prior to 5.1 Description The Export All URLs WordPress plugin versions before 5.1 creates CSV filenames with predictable patterns based on post URLs, including those for private posts. These files are saved in the publicly accessible 'wp-content/uploads/' directory, allowing unauthenticated users to potentially access sensitive data by brute-forcing the filenames. Recommendations Update the Export All URLs WordPress plugin to version 5.1 or later.