Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 237,438 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wp-google-map-plugin
WP Maps
28 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 25, 2026WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters: Local File InclusionCVE-2026-13456 · affects up to 4.9.8 · reported by WordfenceHigh 7.5
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 25, 2026WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters: Stored Cross-Site ScriptingCVE-2026-13179 · affects up to 4.9.8 · reported by WordfenceMedium 6.4
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapes_values Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fc-call-nonce nonce required by the endpoint is exposed to all frontend visitors who view a map page via window.wpgmp_local.nonce, enabling any authenticated subscriber to read the nonce and craft a valid request; additionally, the secondary _wpnonce check in the drawing handler can be bypassed by simply omitting the _wpnonce parameter from the request.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2026Administrator SQL Injection in WP Maps <= 4.9.9 versions.CVE-2026-66618 · affects up to 4.9.9 · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Maps <= 4.9.9 versions.
Aug 19, 2026WP Maps: Does not perform a capability checkCVE-2026-18466 · fixed in 4.9.8 · reported by WPScanMedium 5.4
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request.
Aug 7, 2026WP Maps: Does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatchesCVE-2026-16265 · fixed in 4.9.7 · reported by WPScanMedium 6.5
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
Aug 7, 2026WP Maps: Does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusionCVE-2026-16263 · fixed in 4.9.7 · reported by WPScanHigh 8.8
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.
Jul 31, 2026WP Maps: Insertion of Sensitive Information Into Sent DataCVE-2026-28144 · affects up to 4.9.6 · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6.
Jun 15, 2026Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.CVE-2026-39492 · affects up to 4.9.1 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.
Jun 6, 2026WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters: Stored Cross-Site ScriptingCVE-2026-9594 · affects up to 4.9.4 · reported by WordfenceMedium 4.4
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'location_messages' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to hold the custom wpgmp_manage_location capability, which is granted to administrators by default but can be assigned to lower-privileged roles via the plugin's Permissions screen.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 18, 2026WP Maps: Does not properly sanitize a parameter before using it in a file pathCVE-2026-6381 · fixed in 4.9.3 · reported by WPScanHigh 7.5
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks.
Apr 16, 2026WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters: Stored Cross-Site ScriptingCVE-2025-13364 · affects up to 4.8.7 · reported by WordfenceMedium 6.4
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'put_wpgm' shortcode in all versions up to, and including, 4.8.7. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Mar 22, 2026WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters: Time-based SQL InjectionCVE-2026-2580 · affects up to 4.9.1 · reported by WordfenceHigh 7.5
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 4.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 11, 2026WP Maps: Time-based blind SQL InjectionCVE-2026-3222 · affects up to 4.9.1 · reported by WordfenceHigh 7.5
The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'location_id' parameter in all versions up to, and including, 4.9.1. This is due to the plugin's database abstraction layer (`FlipperCode_Model_Base::is_column()`) treating user input wrapped in backticks as column names, bypassing the `esc_sql()` escaping function. Additionally, the `wpgmp_ajax_call` AJAX handler (registered for unauthenticated users via `wp_ajax_nopriv`) allows calling arbitrary class methods including `wpgmp_return_final_capability`, which passes the unsanitized `location_id` GET parameter directly to a database query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 16, 2026WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters: Local File InclusionCVE-2025-12062 · affects up to 4.8.6 · reported by WordfenceHigh 8.8
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8.6 via the fc_load_template function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .html files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .html file types can be uploaded and included.
Dec 9, 2025WP Maps: Deserialization of Untrusted DataCVE-2025-67535 · affects up to 4.8.6 · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in Flipper Code - WordPress Development Company WP Maps wp-google-map-plugin allows Object Injection.This issue affects WP Maps: from n/a through <= 4.8.6.
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3504 · fixed in 4.7.2 · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3503 · fixed in 4.7.2 · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3502 · fixed in 4.7.2 · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Jun 29, 2024WordPress Plugin for Google Maps – WP MAPS: SQL InjectionCVE-2024-2386 · affects up to 4.6.1 · reported by WordfenceHigh 8.8
The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all versions up to, and including, 4.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Nov 12, 2023flippercode WordPress Plugin for Google Maps – WP MAPS: Cross-Site Request Forgery (CSRF)CVE-2023-28172 · affects up to 4.4.2 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS (formerly WP Google Map Plugin) plugin <= 4.4.2 versions.
Apr 4, 2023Auth.CVE-2023-23878 · fixed in 4.4.0 · reported by PatchstackMedium 5.9
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS plugin <= 4.3.9 versions.
Mar 11, 2022Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3)CVE-2022-25600 · affects up to 4.2.3 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3).
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.CVE-2015-9309 · fixed in 2.3.10 · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.CVE-2015-9308 · fixed in 2.3.10 · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.CVE-2015-9307 · fixed in 2.3.10 · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
Aug 12, 2019The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.CVE-2016-10878 · fixed in 3.1.2 · reported by MITREMedium 6.1
The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.
Aug 12, 2019The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.CVE-2015-9305 · fixed in 2.3.7 · reported by MITREMedium 6.1
The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
May 14, 2018WP Google Map Plugin prior to version 4.0.4 for: Cross-site scriptingCVE-2018-0577 · fixed in 4.0.4 · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.