VulnSocial

CVE-2026-2580Active Exploitation

LOWCVSS 7.5 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 4.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-03-13); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-03-13: 1Mentions · 2026-03-23: 1Mentions · 2026-03-24: 1Active Exploitation · 2026-03-13: 1Technical Details · 2026-03-13: 1Technical Details · 2026-03-23: 103-1303-2303-24
Signal classification3 categories
Active Exploitation
133.3%
Disclosure
133.3%
General
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-03-131
Active Exploitation1
2026-03-231
Disclosure1
2026-03-241
General1
Full discourse3 posts
  • Raed alroomi@master_roomi
    Active Exploitation

    استغلال ثغرات "Zero-day" في المتصفحات: رصدت تقارير أمنية اليوم حملة استغلال واسعة لثغرة في محرك (V8) لمتصفحات كروم وإيدج (تحت المعرف CVE-2026-2580). الهجوم يعتمد على "تسميم" الإعلانات في المواقع الإخبارية الكبرى لتحميل برمجيات تجسس دون تفاعل من المستخدم (Drive-by Download)

    Post summary

    Reports indicate an active exploitation campaign targeting CVE‑2026‑2580 in Chrome and Edge via drive‑by ad delivery, with no PoC, patch, or false‑positive information mentioned.

    00010251
    12.8K followersView on X
  • CVEarity@CVEarity
    General

    ⚡ New CVE Alert: CVE-2026-2580 📊 Severity: 7.5 🚨 Risk Level: High 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-2580 #CVE-2026-2580 #CVE #High #Wordpress #CyberSecurity #InfoSec https://t.co/HMmlJlZAP5

    Post summary

    The tweet simply announces the existence of CVE-2026-2580 for WordPress with a severity rating, without providing any proof of concept, exploitation details, or remediation information.

    0000019
    111 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-2580 The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby… https://www.cve.org/CVERecord?id=CVE-2026-2580

    Post summary

    The post announces a time‑based SQL Injection flaw in the WP Maps plugin, providing minimal technical details but no evidence of exploitation, a PoC, or a patch.

    0000094
    56.8K followersView on X

Explore more

Back to dashboard