VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings security & vulnerabilities

wp-google-map-plugin— active installsLast vulnerability Sep 24, 2026

No known unpatched vulnerabilities in the latest version

All 31 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
31Known vulnerabilities
  • Critical0
  • High13
  • Medium18
  • Low0
Vulnerabilities per year
2015: 5 vulnerabilities5152016: 1 vulnerability1162018: 1 vulnerability1182019: 2 vulnerabilities2192020: 1 vulnerability1202022: 1 vulnerability1222023: 2 vulnerabilities2232024: 1 vulnerability1242025: 4 vulnerabilities4252026: 13 vulnerabilities1326

All WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings vulnerabilities

WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter
≤4.9.8Update to 5.0.0
CVE-2026-13179
High7.5Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter
≤4.9.8Update to 5.0.0
CVE-2026-13456
Medium4.9Authenticated (Administrator+) SQL Injection
≤4.9.9Update to 5.0.0
CVE-2026-66618
Medium4.3Missing Authorization
<4.9.8Update to 4.9.8
CVE-2026-18466
Medium6.5Authenticated (Subscriber+) Denial of Service
≤4.9.6Update to 4.9.7
CVE-2026-16265
Medium4.3Authenticated (Subscriber+) Information Exposure
≤4.9.6Update to 4.9.7
CVE-2026-28144
High7.5Authenticated (Subscriber+) Local File Inclusion
<4.9.3Update to 4.9.3
CVE-2026-6381
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter
≤4.9.4Update to 4.9.5
CVE-2026-9594
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode
≤4.8.7Update to 4.8.8
CVE-2025-13364
High7.5Unauthenticated SQL Injection
≤4.9.1Update to 4.9.2
CVE-2026-39492
High7.5Unauthenticated SQL Injection via 'orderby' Parameter
≤4.9.1Update to 4.9.2
CVE-2026-2580
High7.5Unauthenticated SQL Injection via 'location_id' Parameter
≤4.9.1Update to 4.9.2
CVE-2026-3222
High8.8Authenticated (Subscriber+) Limited Local File Inclusion
≤4.8.6Update to 4.8.7
CVE-2025-12062
Medium6.6Authenticated (Administrator+) PHP Object Injection
≤4.8.6Update to 4.8.7
CVE-2025-67535
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.7.1Update to 4.7.2
CVE-2025-3502
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.7.1Update to 4.7.2
CVE-2025-3503
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.7.1Update to 4.7.2
CVE-2025-3504
High8.8Authenticated (Contributor+) SQL Injection
≤4.6.1Update to 4.6.2
CVE-2024-2386
Medium5.4Cross-Site Request Forgery via delete()
≤4.4.2Update to 4.4.3
CVE-2023-28172
Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
≤4.3.9Update to 4.4.0
CVE-2023-23878
Medium5.4Cross-Site Request Forgery
<4.2.4Update to 4.2.4
CVE-2022-25600
High7.2Authenticated SQL Injection via Orderby
≤4.1.4Update to 4.1.5
CVE-2021-24130
High8.8Cross-Site Request Forgery to PHP Object Injection
<4.1.0Update to 4.1.0
—
Medium6.1Reflected Cross-Site Scripting
≤4.0.9Update to 4.1.0
—
Medium5.4Cross-Site Scripting
<4.0.4Update to 4.0.4
CVE-2018-0577
Medium6.1Cross-Site Scripting
<3.1.2Update to 3.1.2
CVE-2016-10878
High8.8Cross-Site Request Forgery
<2.3.10Update to 2.3.10
CVE-2015-9308
High8.8Cross-Site Request Forgery
<2.3.10Update to 2.3.10
CVE-2015-9309
High8.8Cross-Site Request Forgery
<2.3.10Update to 2.3.10
CVE-2015-9307
High7.1Cross-Site Request Forgery to Cross-Site Scripting
<3.0.0Update to 3.0.0
—
Medium6.1Reflected Cross-Site Scripting
<2.3.7Update to 2.3.7
CVE-2015-9305

WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings: common questions

Does WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings have known vulnerabilities?

Yes. VulnCrest Radar lists 31 known vulnerabilities in WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings: 13 high, 18 medium. None are known to affect version null.

How do I check which version of WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings vulnerability?

CVE-2026-13179, published Sep 24, 2026: WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter. Severity: Medium (CVSS 6.4).

Is any WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings vulnerability listed in CISA KEV?

No. None of the known WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?