Vulnerabilities and security researches forwp-google-map-plugin wp-google-map-plugin
Direction: ascendingJun 07, 2024
WordPress Plugin for Google Maps – WP MAPS # CVE-2015-9305
- CVE, Research URL
- Application
- Date
- Aug 12, 2019
- Research Description
- The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
- Affected versions
-
max 2.3.7.
- Status
-
vulnerable
WordPress Plugin for Google Maps – WP MAPS # CVE-2022-25600
- CVE, Research URL
- Application
- Date
- Mar 11, 2022
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3).
- Affected versions
-
max 4.4.3.
- Status
-
vulnerable
WordPress Plugin for Google Maps – WP MAPS # CVE-2021-24130
- CVE, Research URL
- Application
- Date
- Mar 18, 2021
- Research Description
- Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user (admin+).
- Affected versions
-
max 4.1.5.
- Status
-
vulnerable
WordPress Plugin for Google Maps – WP MAPS # CVE-2015-9309
- CVE, Research URL
- Application
- Date
- Aug 14, 2019
- Research Description
- The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
- Affected versions
-
max 2.3.10.
- Status
-
vulnerable
WordPress Plugin for Google Maps – WP MAPS # CVE-2015-9308
- CVE, Research URL
- Application
- Date
- Aug 14, 2019
- Research Description
- The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
- Affected versions
-
max 2.3.10.
- Status
-
vulnerable
WordPress Plugin for Google Maps – WP MAPS # CVE-2016-10878
- CVE, Research URL
- Application
- Date
- Aug 12, 2019
- Research Description
- The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.
- Affected versions
-
max 3.1.2.
- Status
-
vulnerable
WordPress Plugin for Google Maps – WP MAPS # CVE-2018-0577
- CVE, Research URL
- Application
- Date
- May 14, 2018
- Research Description
- Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Affected versions
-
max 3.0.0.
- Status
-
vulnerable
WordPress Plugin for Google Maps – WP MAPS # CVE-2023-23878
- CVE, Research URL
- Application
- Date
- Apr 04, 2023
- Research Description
- Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS plugin <= 4.3.9 versions.
- Affected versions
-
max 4.4.0.
- Status
-
vulnerable
WordPress Plugin for Google Maps – WP MAPS # CVE-2023-28172
- CVE, Research URL
- Application
- Date
- Nov 13, 2023
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS (formerly WP Google Map Plugin) plugin <= 4.4.2 versions.
- Affected versions
-
max 3.0.0.
- Status
-
vulnerable
WordPress Plugin for Google Maps – WP MAPS # CVE-2015-9307
- CVE, Research URL
- Application
- Date
- Aug 14, 2019
- Research Description
- The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
- Affected versions
-
max 2.3.10.
- Status
-
vulnerable
Jul 01, 2024
WordPress Plugin for Google Maps – WP MAPS # CVE-2024-2386
- CVE, Research URL
- Application
- Date
- Jun 29, 2024
- Research Description
- The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all versions up to, and including, 4.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 4.6.2.
- Status
-
vulnerable
May 07, 2025
WordPress Plugin for Google Maps – WP MAPS # CVE-2025-3503
- CVE, Research URL
- Application
- Date
- May 01, 2025
- Research Description
- The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Affected versions
-
max 4.7.2.
- Status
-
vulnerable
WordPress Plugin for Google Maps – WP MAPS # CVE-2025-3502
- CVE, Research URL
- Application
- Date
- May 01, 2025
- Research Description
- The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Affected versions
-
max 4.7.2.
- Status
-
vulnerable
Jan 09, 2026
WordPress Plugin for Google Maps – WP MAPS # CVE-2025-67535
- CVE, Research URL
- Application
- Date
- Dec 09, 2025
- Research Description
- Deserialization of Untrusted Data vulnerability in WePlugins - WordPress Development Company WP Maps wp-google-map-plugin allows Object Injection.This issue affects WP Maps: from n/a through <= 4.8.6.
- Affected versions
-
max 4.8.6.
- Status
-
vulnerable
Mar 30, 2026
WordPress Plugin for Google Maps – WP MAPS # CVE-2025-12062
- CVE, Research URL
- Application
- Date
- Feb 17, 2026
- Research Description
- The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8.6 via the fc_load_template function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .html files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .html file types can be uploaded and included.
- Affected versions
-
max 4.8.7.
- Status
-
vulnerable
Apr 13, 2026
WordPress Plugin for Google Maps – WP MAPS # CVE-2026-2580
- CVE, Research URL
- Application
- Date
- Mar 23, 2026
- Research Description
- The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 4.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 4.9.2.
- Status
-
vulnerable
Apr 14, 2026
WordPress Plugin for Google Maps – WP MAPS # CVE-2026-3222
- CVE, Research URL
- Application
- Date
- Mar 11, 2026
- Research Description
- The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'location_id' parameter in all versions up to, and including, 4.9.1. This is due to the plugin's database abstraction layer (`FlipperCode_Model_Base::is_column()`) treating user input wrapped in backticks as column names, bypassing the `esc_sql()` escaping function. Additionally, the `wpgmp_ajax_call` AJAX handler (registered for unauthenticated users via `wp_ajax_nopriv`) allows calling arbitrary class methods including `wpgmp_return_final_capability`, which passes the unsanitized `location_id` GET parameter directly to a database query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 4.9.2.
- Status
-
vulnerable
Apr 16, 2026
WordPress Plugin for Google Maps – WP MAPS # CVE-2026-39492
- CVE, Research URL
- Application
- Date
- -
- Research Description
- WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters [wp-google-map-plugin] < 4.9.2 CVE-2026-39492
- Affected versions
-
max 4.9.2.
- Status
-
vulnerable
WordPress Plugin for Google Maps – WP MAPS # CVE-2025-13364
- CVE, Research URL
- Application
- Date
- Apr 16, 2026
- Research Description
- The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'put_wpgm' shortcode in all versions up to, and including, 4.8.7. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 4.8.8.
- Status
-
vulnerable
Apr 25, 2026
WordPress Plugin for Google Maps – WP MAPS # CVE-2025-3504
- CVE, Research URL
- Application
- Date
- May 01, 2025
- Research Description
- The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Affected versions
-
max 4.7.2.
- Status
-
vulnerable