Plugin icon

WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters

wp-google-map-plugin

Vulnerabilities:

18

Last Updated:

March 5, 2026

Active Installs:

60000

Published
Title
Fixed in
CVSS
Published
2026-03-22
Title
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters < 4.9.2 - Unauthenticated SQL Injection via 'orderby' Parameter
Fixed in
Fixed in 4.9.2
CVSS
7.5 (high)
Published
2026-03-10
Title
WP Maps < 4.9.2 - Unauthenticated SQL Injection via 'location_id' Parameter
Fixed in
Fixed in 4.9.2
CVSS
7.5 (high)
Published
2026-02-16
Title
WP Maps < 4.8.7 - Subscriber+ Limited Local File Inclusion
Fixed in
Fixed in 4.8.7
CVSS
7.5 (high)
Published
2025-11-02
Title
Maps < 4.8.7 - Authenticated (Administrator+) PHP Object Injection
Fixed in
Fixed in 4.8.7
CVSS
6.6 (medium)
Published
2025-04-10
Title
WP Maps < 4.7.2 - Admin+ Stored XSS
Fixed in
Fixed in 4.7.2
CVSS
3.5 (low)
Published
2025-04-10
Title
WP Maps < 4.7.2 - Admin+ Stored XSS
Fixed in
Fixed in 4.7.2
CVSS
3.5 (low)
Published
2025-04-10
Title
WP Maps < 4.7.2 - Admin+ Stored XSS
Fixed in
Fixed in 4.7.2
CVSS
3.5 (low)
Published
2024-06-28
Title
WordPress Plugin for Google Maps – WP MAPS < 4.6.2 - Authenticated (Contributor+) SQL Injection
Fixed in
Fixed in 4.6.2
CVSS
8.8 (high)
Published
2023-01-20
Title
WP Google Map < 4.4.0 - Editor+ Stored XSS
Fixed in
Fixed in 4.4.0
CVSS
3.5 (low)
Published
2022-03-13
Title
WP Google Map < 4.4.3 - Category/Location/Map Deletion via CSRF
Fixed in
Fixed in 4.4.3
CVSS
4.3 (medium)
Published
2022-02-22
Title
WP Google Map < 4.2.4 - Marker Category/Map Deletion via CSRF
Fixed in
Fixed in 4.2.4
CVSS
4.3 (medium)
Published
2020-11-25
Title
WP Google Map Plugin < 4.1.5 - Authenticated SQL Injection
Fixed in
Fixed in 4.1.5
CVSS
6.6 (medium)
Published
2019-09-19
Title
WP Google Map Plugin < 4.1.0 - CSRF to Unauthenticated PHP Object Injection
Fixed in
Fixed in 4.1.0
CVSS
8.2 (high)
Published
2018-04-27
Title
WP Google Map < 4.0.4 - XSS
Fixed in
Fixed in 4.0.4
CVSS
6.1 (medium)
Published
2016-07-27
Title
WP Google Map Plugin < 3.1.2 - XSS
Fixed in
Fixed in 3.1.2
CVSS
6.1 (medium)
Published
2015-08-21
Title
WP Google Map Plugin < 2.3.10 - Multiple CSRF
Fixed in
Fixed in 2.3.10
CVSS
5.4 (medium)
Published
2015-08-20
Title
WP Google Map Plugin < 3.0.0 - CSRF to Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 3.0.0
CVSS
8.2 (high)
Published
2015-04-24
Title
WP Google Map Plugin < 2.3.7 - XSS
Fixed in
Fixed in 2.3.7
CVSS
6.1 (medium)