WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters

Information

Software Type Plugin
Software Slug wp-google-map-plugin (view on wordpress.org)
Software Status Active
Software Author flippercode
Software Website weplugins.com
Software Downloads 3,666,467
Software Active Installs 60,000
Software Record Last Updated July 19, 2026

Showing 1-20 of 25 Vulnerabilities

Submit a Vulnerability
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 - Authenticated (Subscriber+) Local File Inclusion
7.5
CVE-2026-6381
Jun 11, 2026
Researcher: Mustafa
WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter
4.4
CVE-2026-9594
Jun 5, 2026
Researcher: Yousef Alraddadi
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode
6.4
CVE-2025-13364
Apr 15, 2026
Researcher: Muhammad Yudha - DJ
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection
7.5
CVE-2026-39492
Apr 8, 2026
Researcher: Nguyen Ba Khanh
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter
7.5
CVE-2026-2580
Mar 22, 2026
Researcher: Chiao-Lin Yu (Steven Meow)
WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter
7.5
CVE-2026-3222
Mar 10, 2026
Researcher: johska
WP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion
8.8
CVE-2025-12062
Feb 16, 2026
Researcher: mikemyers
Maps <= 4.8.6 - Authenticated (Administrator+) PHP Object Injection
6.6
CVE-2025-67535
Nov 2, 2025
Researcher: Aitor F (kr0no)
WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-3503
Apr 10, 2025
Researcher: Dmitrii Ignatyev
WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-3502
Apr 10, 2025
Researcher: Dmitrii Ignatyev
WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-3504
Apr 10, 2025
Researcher: Dmitrii Ignatyev
WordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injection
8.8
CVE-2024-2386
Jun 28, 2024
Researcher: Krzysztof Zając
WP Google Map Plugin <= 4.4.2 - Cross-Site Request Forgery via delete()
5.4
CVE-2023-28172
Mar 13, 2023
Researcher: Rafie Muhammad
WP MAPS <= 4.3.9 - Authenticated (Editor+) Stored Cross-Site Scripting
5.5
CVE-2023-23878
Jan 20, 2023
Researcher: Rafshanzani Suhada
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.2.3 - Cross-Site Request Forgery
5.4
CVE-2022-25600
Feb 22, 2022
Researcher: R3N0
WP Google Map Plugin <= 4.1.4 - Authenticated SQL Injection via Orderby
7.2
CVE-2021-24130
Nov 25, 2020
Researcher: Nguyen Anh Tien
WP Google Map Plugin <= 4.0.9 - Cross-Site Request Forgery to PHP Object Injection
8.8
CVE ID Unknown
Sep 21, 2019
Researchers:
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.0.9 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Sep 21, 2019
Researchers:
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps < 4.0.4 - Cross-Site Scripting
5.4
CVE-2018-0577
Apr 27, 2018
Researchers:
WP Google Map Plugin <= 3.1.1 - Cross-Site Scripting
6.1
CVE-2016-10878
Jul 27, 2016
Researchers:
Title Status CVE ID CVSS Researchers Date
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 - Authenticated (Subscriber+) Local File Inclusion Patched CVE-2026-6381 7.5 Mustafa June 11, 2026
WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter Patched CVE-2026-9594 4.4 Yousef Alraddadi June 5, 2026
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode Patched CVE-2025-13364 6.4 Muhammad Yudha - DJ April 15, 2026
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection Patched CVE-2026-39492 7.5 Nguyen Ba Khanh April 8, 2026
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter Patched CVE-2026-2580 7.5 Chiao-Lin Yu (Steven Meow) March 22, 2026
WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter Patched CVE-2026-3222 7.5 johska March 10, 2026
WP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion Patched CVE-2025-12062 8.8 mikemyers February 16, 2026
Maps <= 4.8.6 - Authenticated (Administrator+) PHP Object Injection Patched CVE-2025-67535 6.6 Aitor F (kr0no) November 2, 2025
WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2025-3503 4.4 Dmitrii Ignatyev April 10, 2025
WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2025-3502 4.4 Dmitrii Ignatyev April 10, 2025
WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2025-3504 4.4 Dmitrii Ignatyev April 10, 2025
WordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injection Patched CVE-2024-2386 8.8 Krzysztof Zając June 28, 2024
WP Google Map Plugin <= 4.4.2 - Cross-Site Request Forgery via delete() Patched CVE-2023-28172 5.4 Rafie Muhammad March 13, 2023
WP MAPS <= 4.3.9 - Authenticated (Editor+) Stored Cross-Site Scripting Patched CVE-2023-23878 5.5 Rafshanzani Suhada January 20, 2023
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.2.3 - Cross-Site Request Forgery Patched CVE-2022-25600 5.4 R3N0 February 22, 2022
WP Google Map Plugin <= 4.1.4 - Authenticated SQL Injection via Orderby Patched CVE-2021-24130 7.2 Nguyen Anh Tien November 25, 2020
WP Google Map Plugin <= 4.0.9 - Cross-Site Request Forgery to PHP Object Injection Patched 8.8 September 21, 2019
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.0.9 - Reflected Cross-Site Scripting Patched 6.1 September 21, 2019
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps < 4.0.4 - Cross-Site Scripting Patched CVE-2018-0577 5.4 April 27, 2018
WP Google Map Plugin <= 3.1.1 - Cross-Site Scripting Patched CVE-2016-10878 6.1 July 27, 2016

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation