CVE-2026-118168

MediumCVSS 5.3/10Last modified Nov 2, 2026

Description

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
UnknownMapPress< 2.97.15

References

Timeline

Published
Nov 1, 2026
Last modified
Nov 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1181694.9The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conCVE-2026-118175.3This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In CVE-2026-1181709.1The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying wheCVE-2026-1181716.5The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-priviCVE-2026-1181726.1The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatCVE-2026-1181736.1MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. CVE-2026-1181746.5When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importCVE-2026-1181757.5When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the CVE-2026-1181768.1Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-lengtCVE-2026-1181779.1When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted caleCVE-2026-1181785.7A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL.CVE-2026-1181798.8Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the lin
CVE-2026-118168: Medium severity, CVSS 5.3 | Vulnix