Plugin icon

WP Go Maps (formerly WP Google Maps)

wp-google-maps

Vulnerabilities:

21

Last Updated:

January 14, 2026

Active Installs:

300000

Published
Title
Fixed in
CVSS
Published
2025-10-21
Title
WP Google Maps < 9.0.48 - Unauthenticated Stored XSS
Fixed in
Fixed in 9.0.48
CVSS
8.8 (high)
Published
2025-10-17
Title
WP Go Maps < 9.0.49 - Unauthenticated Cache Poisoning
Fixed in
Fixed in 9.0.49
CVSS
5.3 (medium)
Published
2025-10-08
Title
WP Go Maps (formerly WP Google Maps) < 9.0.47 - Cross-Site Request Forgery to Plugin Settings Update
Fixed in
Fixed in 9.0.47
CVSS
5.4 (medium)
Published
2025-01-24
Title
WP Go Maps < 9.0.41 - Cross-Site Request Forgery
Fixed in
Fixed in 9.0.41
CVSS
4.3 (medium)
Published
2024-06-13
Title
WP Go Maps (formerly WP Google Maps) < 9.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 9.0.39
CVSS
6.4 (medium)
Published
2024-05-23
Title
WP Go Maps < 9.0.37 - Contributor+ Stored XSS via Shortcode
Fixed in
Fixed in 9.0.37
CVSS
5.9 (medium)
Published
2024-03-25
Title
WP Google Maps < 9.0.30 - Reflected Cross-Site Scripting
Fixed in
Fixed in 9.0.30
CVSS
7.1 (high)
Published
2024-03-18
Title
WP Go Maps < 9.0.35 - Information Exposure to Potential Denial of Service
Fixed in
Fixed in 9.0.35
CVSS
5.3 (medium)
Published
2024-03-12
Title
WP Go Maps < 9.0.33 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 9.0.33
CVSS
4.4 (medium)
Published
2024-03-12
Title
WP Go Maps (formerly WP Google Maps) < 9.0.33 - Contributor+ Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 9.0.33
CVSS
6.4 (medium)
Published
2024-01-23
Title
WP Go Maps (formerly WP Google Maps) < 9.0.29 - Unauthenticated Reflected Cross-Site Scripting
Fixed in
Fixed in 9.0.29
CVSS
6.1 (medium)
Published
2023-12-12
Title
WP Go Maps < 9.0.28 - Unauthenticated Stored XSS
Fixed in
Fixed in 9.0.28
CVSS
8.8 (high)
Published
2023-01-20
Title
WP Google Maps < 9.0.16 - Admin+ Path Traversal
Fixed in
Fixed in 9.0.16
CVSS
2.7 (low)
Published
2021-06-15
Title
WP Google Maps < 8.1.13 - Multiple Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 8.1.13
CVSS
3.5 (low)
Published
2021-06-07
Title
WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 8.1.12
CVSS
4.8 (medium)
Published
2019-07-08
Title
WP Google Maps <= 7.11.34 - CSRF to Stored XSS
Fixed in
Fixed in 7.11.35
CVSS
5.4 (medium)
Published
2019-06-03
Title
WP Google Maps <= 7.11.27 - Admin Settings CSRF
Fixed in
Fixed in 7.11.28
CVSS
n/a
Published
2019-04-02
Title
WP Google Maps 7.11.00-7.11.17 - Unauthenticated SQL Injection
Fixed in
Fixed in 7.11.18
CVSS
9.8 (critical)
Published
2019-02-05
Title
WP Google Maps < 7.10.43 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 7.10.43
CVSS
6.1 (medium)
Published
2016-11-10
Title
WP Google Maps <= 6.3.14 - Authenticated Stored Cross-Site Scripting (XSS) via CSRF
Fixed in
Fixed in 6.3.15
CVSS
n/a
Published
2014-10-15
Title
WP Google Maps 6.0.26 - Cross Site Scripting (XSS)
Fixed in
Fixed in 6.0.27
CVSS
n/a