CVE-2025-11999
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Nov 11, 2025
CISA due date
—
The record
The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarker_reset_map() and amm_save_map_api() functions in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to update the map API and reset maps.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-55147 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application… CWE-862
- CVE-2026-55146 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application… CWE-862
- CVE-2026-62967 ZTNET is a ZeroTier web UI for private controllers with multiuser and organization… CWE-862
- CVE-2026-62989 Shopper is a Headless e-commerce Admin Panel. CWE-862
- CVE-2026-78403 Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel… CWE-862
- CVE-2026-62301 MyTube is a self-hosted downloader and player for several video websites. CWE-862
- CVE-2026-119337 RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. CWE-862
- CVE-2026-116245 libpq looks a connection service up in the service file of the operating-system account… CWE-862