Super Interactive Maps Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Interactive Maps super-interactive-maps allows Reflected XSS.This issue affects Super Interactive Maps: from n/a through <= 2.3.

Affected:

up to 2.3

Fix:

No patched version reported

Disclosed:

Jan 22, 2026

CVE-2025-49045 on NVD →

The Super Interactive Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can success...

CVSS:

6.1

Affected:

up to 2.3

Fix:

No patched version reported

Disclosed:

Jan 8, 2026

CVE-2025-49045 on NVD →

The Super Store Finder plugin in versions up to, and including 6.4 and the Super Interactive Maps plugin in versions up to, and including 2.1 for WordPress are vulnerable to SQL Injection via the ‘ssf_wp_id’ parameter due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVSS:

9.8

Affected:

up to 2.2

Fixed in:

2.2

Disclosed:

Mar 8, 2021

Unauthenticated SQL Injection (SQLi) vulnerability discovered by Eagle Eye in WordPress Super Interactive Maps premium plugin (versions <= 2.1).

Affected:

up to 2.2

Fixed in:

2.2

Disclosed:

Mar 8, 2021

The Super Store Finder plugin in versions up to, and including 6.4 and the Super Interactive Maps plugin in versions up to, and including 2.1 for WordPress are vulnerable to SQL Injection via the ‘ssf_wp_id’ parameter due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

Affected:

up to 2.2

Fixed in:

2.2

Disclosed:

Mar 8, 2021

The Super Store Finder, Super Interactive Maps, and Super Logo Showcase plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation in the /pages/import.php file in versions up to, and including, 6.1, 1.9. and 2.2 respectively. This makes it possible for unauthenticated attackers...

CVSS:

8.8

Affected:

up to 1.9

Fixed in:

2.0

Disclosed:

Oct 21, 2020

Unauthenticated Arbitrary File Upload vulnerability found by Eagle Eye in WordPress Super Interactive Maps premium plugin (versions <= 1.9).

Affected:

up to 2.0

Fixed in:

2.0

Disclosed:

Oct 21, 2020

The Super Store Finder, Super Interactive Maps, and Super Logo Showcase plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation in the /pages/import.php file in versions up to, and including, 6.1, 1.9. and 2.2 respectively. This makes it possible for unauthenticated attackers...

Affected:

up to 2.0

Fixed in:

2.0

Disclosed:

Oct 21, 2020

The ssf-social-action.php and sim-wp-data.php files from the respective superstorefinder-wp (&lt;= 6.3) and super-interactive-maps (&lt;= 2.1) plugins are effected by Multiple Unauthenticated SQL Injections, as they do not sanitise user data before using them in SQL statements. superstorefinder-wp fixed most of the...

Affected:

up to 2.2

Fixed in:

2.2

The SuperStoreFinder premium WordPress plugins did not properly check file uploads, depending on the plugin, only checking for the mime type and/or the first extension of the file name. An attacker could set the Content-Type header to &quot;Content-Type: text/csv&quot;, as well as use a double extension to bypass th...

Affected:

up to 2.0

Fixed in:

2.0