WP Google Maps <= 7.11.34 - Cross-Site Request Forgery to Cross-Site Scripting

Wordfence Intelligence   >   Vulnerability Database   >   WP Google Maps <= 7.11.34 - Cross-Site Request Forgery to Cross-Site Scripting
6.1
Cross-Site Request Forgery (CSRF)
CVE CVE-2019-14792
CVSS 6.1 (Medium)
Publicly Published July 8, 2019
Last Updated January 22, 2024

Description

The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.

References

Share

Vulnerability Details for WP Go Maps – Google Map, OpenStreetMap, Leaflet Map

WP Go Maps – Google Map, OpenStreetMap, Leaflet Map

Software Type Plugin
Software Slug wp-google-maps (view on wordpress.org)
Patched? Yes
Remediation Update to version 7.11.35, or a newer patched version
Affected Version
  • < 7.11.35
Patched Version
  • 7.11.35

Recent vulnerabilities in WP Go Maps – Google Map, OpenStreetMap, Leaflet Map

WP Go Maps – Google Map, OpenStreetMap, Leaflet Map < 10.1.04 - Unauthenticated SQL Injection
7.5
CVE-2026-15381
Aug 4, 2026
Researcher: Jakub Herman
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map <= 10.1.05 - Missing Authorization
5.3
CVE-2026-25466
Jul 22, 2026
Researcher: Bao - BlueRock
WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation
5.3
CVE-2026-12238
Jun 19, 2026
Researcher: Thanh Điềm
WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback
5.3
CVE-2026-8385
Jun 5, 2026
Researcher: Sudhanshu Chauhan
Go Maps <= 10.0.9 - Unauthenticated Information Exposure
5.3
CVE-2026-8386
May 25, 2026
Researcher: Sudhanshu Chauhan
WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings
6.4
CVE-2026-4268
Mar 17, 2026
Researcher: bashu
WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification
5.3
CVE-2026-0593
Jan 24, 2026
Researcher: Moose Love
Google Maps <= 9.0.47 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2025-11307
Oct 21, 2025
Researcher: sunghoon kim
WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning
5.3
CVE-2025-11703
Oct 17, 2025
Researcher: Dmitrii Ignatyev
WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update
5.4
CVE-2025-11166
Oct 8, 2025
Researcher: Dmitrii Ignatyev
# Title CVE ID CVSS Researchers Date
1 WP Go Maps – Google Map, OpenStreetMap, Leaflet Map < 10.1.04 - Unauthenticated SQL Injection CVE-2026-15381 7.5 Jakub Herman August 4, 2026
2 WP Go Maps – Google Map, OpenStreetMap, Leaflet Map <= 10.1.05 - Missing Authorization CVE-2026-25466 5.3 Bao - BlueRock July 22, 2026
3 WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation CVE-2026-12238 5.3 Thanh Điềm June 19, 2026
4 WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback CVE-2026-8385 5.3 Sudhanshu Chauhan June 5, 2026
5 Go Maps <= 10.0.9 - Unauthenticated Information Exposure CVE-2026-8386 5.3 Sudhanshu Chauhan May 25, 2026
6 WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings CVE-2026-4268 6.4 bashu March 17, 2026
7 WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification CVE-2026-0593 5.3 Moose Love January 24, 2026
8 Google Maps <= 9.0.47 - Unauthenticated Stored Cross-Site Scripting CVE-2025-11307 7.2 sunghoon kim October 21, 2025
9 WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning CVE-2025-11703 5.3 Dmitrii Ignatyev October 17, 2025
10 WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update CVE-2025-11166 5.4 Dmitrii Ignatyev October 8, 2025
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation