WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters

Information

Software Type Plugin
Software Slug wp-google-map-plugin (view on wordpress.org)
Software Status Active
Software Author flippercode
Software Website weplugins.com
Software Downloads 3,770,877
Software Active Installs 60,000
Software Record Last Updated September 9, 2026

Showing 1-20 of 28 Vulnerabilities

Submit a Vulnerability
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.8 - Missing Authorization
4.3
CVE-2026-18466
Aug 21, 2026
Researcher: Xanlar Agamalizade
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.6 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-28144
Jul 31, 2026
Researcher: Ananda Dhakal
WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter
4.4
CVE-2026-9594
Jun 5, 2026
Researcher: Yousef Alraddadi
WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-3504
Apr 10, 2025
Researcher: Dmitrii Ignatyev
WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-3503
Apr 10, 2025
Researcher: Dmitrii Ignatyev
WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-3502
Apr 10, 2025
Researcher: Dmitrii Ignatyev
WP Google Map Plugin <= 4.4.2 - Cross-Site Request Forgery via delete()
5.4
CVE-2023-28172
Mar 13, 2023
Researcher: Rafie Muhammad
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.2.3 - Cross-Site Request Forgery
5.4
CVE-2022-25600
Feb 22, 2022
Researcher: R3N0
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps < 4.0.4 - Cross-Site Scripting
5.4
CVE-2018-0577
Apr 27, 2018
Researchers:
WP MAPS <= 4.3.9 - Authenticated (Editor+) Stored Cross-Site Scripting
5.5
CVE-2023-23878
Jan 20, 2023
Researcher: Rafshanzani Suhada
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.0.9 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Sep 21, 2019
Researchers:
WP Google Map Plugin <= 3.1.1 - Cross-Site Scripting
6.1
CVE-2016-10878
Jul 27, 2016
Researchers:
WP Google Map Plugin < 2.3.7 - Reflected Cross-Site Scripting
6.1
CVE-2015-9305
Apr 24, 2015
Researchers:
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode
6.4
CVE-2025-13364
Apr 15, 2026
Researcher: Muhammad Yudha - DJ
Maps <= 4.9.6 - Authenticated (Subscriber+) Denial of Service
6.5
CVE-2026-16265
Aug 3, 2026
Researcher: Mohammad Aghdasi
Maps <= 4.8.6 - Authenticated (Administrator+) PHP Object Injection
6.6
CVE-2025-67535
Nov 2, 2025
Researcher: Aitor F (kr0no)
WP Google Map Plugin < 3.0.0 - Cross-Site Request Forgery to Cross-Site Scripting
7.1
CVE ID Unknown
Aug 20, 2015
Researcher: Marcin Probola
WP Google Map Plugin <= 4.1.4 - Authenticated SQL Injection via Orderby
7.2
CVE-2021-24130
Nov 25, 2020
Researcher: Nguyen Anh Tien
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 - Authenticated (Subscriber+) Local File Inclusion
7.5
CVE-2026-6381
Jun 11, 2026
Researcher: Mustafa
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection
7.5
CVE-2026-39492
Apr 8, 2026
Researcher: Nguyen Ba Khanh
Title Status CVE ID CVSS Researchers Date
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.8 - Missing Authorization Patched CVE-2026-18466 4.3 Xanlar Agamalizade August 21, 2026
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.6 - Authenticated (Subscriber+) Information Exposure Patched CVE-2026-28144 4.3 Ananda Dhakal July 31, 2026
WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter Patched CVE-2026-9594 4.4 Yousef Alraddadi June 5, 2026
WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2025-3504 4.4 Dmitrii Ignatyev April 10, 2025
WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2025-3503 4.4 Dmitrii Ignatyev April 10, 2025
WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2025-3502 4.4 Dmitrii Ignatyev April 10, 2025
WP Google Map Plugin <= 4.4.2 - Cross-Site Request Forgery via delete() Patched CVE-2023-28172 5.4 Rafie Muhammad March 13, 2023
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.2.3 - Cross-Site Request Forgery Patched CVE-2022-25600 5.4 R3N0 February 22, 2022
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps < 4.0.4 - Cross-Site Scripting Patched CVE-2018-0577 5.4 April 27, 2018
WP MAPS <= 4.3.9 - Authenticated (Editor+) Stored Cross-Site Scripting Patched CVE-2023-23878 5.5 Rafshanzani Suhada January 20, 2023
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.0.9 - Reflected Cross-Site Scripting Patched 6.1 September 21, 2019
WP Google Map Plugin <= 3.1.1 - Cross-Site Scripting Patched CVE-2016-10878 6.1 July 27, 2016
WP Google Map Plugin < 2.3.7 - Reflected Cross-Site Scripting Patched CVE-2015-9305 6.1 April 24, 2015
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode Patched CVE-2025-13364 6.4 Muhammad Yudha - DJ April 15, 2026
Maps <= 4.9.6 - Authenticated (Subscriber+) Denial of Service Patched CVE-2026-16265 6.5 Mohammad Aghdasi August 3, 2026
Maps <= 4.8.6 - Authenticated (Administrator+) PHP Object Injection Patched CVE-2025-67535 6.6 Aitor F (kr0no) November 2, 2025
WP Google Map Plugin < 3.0.0 - Cross-Site Request Forgery to Cross-Site Scripting Patched 7.1 Marcin Probola August 20, 2015
WP Google Map Plugin <= 4.1.4 - Authenticated SQL Injection via Orderby Patched CVE-2021-24130 7.2 Nguyen Anh Tien November 25, 2020
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 - Authenticated (Subscriber+) Local File Inclusion Patched CVE-2026-6381 7.5 Mustafa June 11, 2026
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection Patched CVE-2026-39492 7.5 Nguyen Ba Khanh April 8, 2026

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation