VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator security & vulnerabilities

wp-google-maps— active installsLast vulnerability Sep 2, 2026

No known unpatched vulnerabilities in the latest version

All 29 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
29Known vulnerabilities
  • Critical1
  • High3
  • Medium25
  • Low0
Vulnerabilities per year
2014: 1 vulnerability1142016: 1 vulnerability1162019: 3 vulnerabilities3192020: 1 vulnerability1202021: 2 vulnerabilities2212023: 2 vulnerabilities2232024: 7 vulnerabilities7242025: 4 vulnerabilities4252026: 8 vulnerabilities826

All WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator vulnerabilities

WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator vulnerabilities
SeverityVulnerabilityCVEPublished
High7.5Unauthenticated Denial of Service
≤10.1.08Update to 10.1.09
CVE-2026-84780
High7.5Unauthenticated SQL Injection
<10.1.04Update to 10.1.04
CVE-2026-15381
Medium5.3Missing Authorization
≤10.1.05Update to 10.1.06
CVE-2026-25466
Medium5.3Unauthenticated Arbitrary Record Creation
≤10.1.01Update to 10.1.02
CVE-2026-12238
Medium5.3Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback
≤10.0.09Update to 10.0.10
CVE-2026-8385
Medium5.3Unauthenticated Information Exposure
≤10.0.9Update to 10.0.10
CVE-2026-8386
Medium6.4Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings
≤10.0.05Update to 10.0.06
CVE-2026-4268
Medium5.3Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification
≤10.0.04Update to 10.0.05
CVE-2026-0593
High7.2Unauthenticated Stored Cross-Site Scripting
≤9.0.47Update to 9.0.48
CVE-2025-11307
Medium5.3Unauthenticated Cache Poisoning
≤9.0.48Update to 9.0.49
CVE-2025-11703
Medium5.4Cross-Site Request Forgery to Plugin Settings Update
≤9.0.46Update to 9.0.47
CVE-2025-11166
Medium4.3Cross-Site Request Forgery
≤9.0.40Update to 9.0.41
CVE-2025-24742
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤9.0.38Update to 9.0.39
CVE-2024-5994
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤9.0.36Update to 9.0.37
CVE-2024-3557
Medium6.1Reflected Cross-Site Scripting
≤9.0.29Update to 9.0.30
CVE-2024-29931
Medium5.3Information Exposure to Potential Denial of Service
≤9.0.34Update to 9.0.35
CVE-2023-6777
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤9.0.32Update to 9.0.33
CVE-2023-4839
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤9.0.32Update to 9.0.33
CVE-2024-1582
Medium6.1Reflected Cross-Site Scripting
≤9.0.28Update to 9.0.29
CVE-2023-6697
Medium6.1Unauthenticated Stored Cross-Site Scripting via REST API
≤9.0.27Update to 9.0.28
CVE-2023-6627
Medium4.9Authenticated (Admin+) Directory Traversal
≤9.0.15Update to 9.0.16
CVE-2022-47595
Medium5.5Authenticated Stored Cross-Site Scripting
<8.1.13Update to 8.1.13
CVE-2021-36870
Medium5.4Authenticated Stored Cross-Site Scripting
<8.1.12Update to 8.1.12
CVE-2021-24383
Critical9.8SQL Injection
≤7.11.17Update to 7.11.18
CVE-2019-10692
Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
<7.11.35Update to 7.11.35
CVE-2019-14792
Medium4.3Cross-Site Request Forgery
<7.11.28Update to 7.11.28
—
Medium6.1Reflected Cross-Site Scripting
≤7.10.41Update to 7.10.43
CVE-2019-9912
Medium6.4Stored Cross-Site Scripting
≤6.3.14Update to 6.3.15
—
Medium6.1Reflected Cross-Site Scripting
<6.0.27Update to 6.0.27
CVE-2014-7182

WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator: common questions

Does WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator have known vulnerabilities?

Yes. VulnCrest Radar lists 29 known vulnerabilities in WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator: 1 critical, 3 high, 25 medium. None are known to affect version null.

How do I check which version of WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator vulnerability?

CVE-2026-84780, published Sep 2, 2026: WP Go Maps – Google Map, OpenStreetMap, Leaflet Map <= 10.1.08 - Unauthenticated Denial of Service. Severity: High (CVSS 7.5).

Is any WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator vulnerability listed in CISA KEV?

No. None of the known WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?