← WordPress Vulnerabilities
WordPress security by component

WP Maps

WP Maps is a WordPress component with 14 published CVE records in this archive. The latest tracked vulnerability was published Jun 15, 2026; the highest CVE/CNA score is 9.3.

Plugin slug: wp-google-map-plugin

CVE-2026-39492: WP Maps: SQL injection

WP Maps is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 4.9.1.

PublishedJun 15, 2026
Known safe version4.9.2
Safe version
Jun 15, 2026 CVE-2026-39492
WP Maps: SQL injection
WP Maps is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 4.9.1.
4.9.2
CVE9.3
NVDPending
Jun 06, 2026 CVE-2026-9594
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters: Cross-site scripting
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters is affected by cross-site scripting. Exploitation requires at least administrator-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.9.4.
> 4.9.4
CVE4.4
NVDPending
Mar 23, 2026 CVE-2026-2580
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters: SQL injection
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE7.5
NVDPending
Mar 11, 2026 CVE-2026-3222
WP Maps: SQL injection
WP Maps is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE7.5
NVDPending
Dec 09, 2025 CVE-2025-67535
WP Maps: Code execution
WP Maps is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
See mitigation notes
CVE6.6
NVDPending
Nov 12, 2023 CVE-2023-28172
Wp Google Map Plugin: Cross-site request forgery
Wp Google Map Plugin is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE5.4
NVD8.8
Apr 04, 2023 CVE-2023-23878
Wp Google Map Plugin: Cross-site scripting
Wp Google Map Plugin is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE5.9
NVD5.4
Mar 11, 2022 CVE-2022-25600
Wp Google Map Plugin: Cross-site request forgery
Wp Google Map Plugin is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE5.4
NVD8.8
Aug 14, 2019 CVE-2015-9309
Wp Google Map Plugin: Cross-site request forgery
Wp Google Map Plugin is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE8.8
NVD8.8
Aug 14, 2019 CVE-2015-9308
Wp Google Map Plugin: Cross-site request forgery
Wp Google Map Plugin is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE8.8
NVD8.8
Aug 14, 2019 CVE-2015-9307
Wp Google Map Plugin: Cross-site request forgery
Wp Google Map Plugin is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE8.8
NVD8.8
Aug 12, 2019 CVE-2016-10878
Wp Google Map Plugin: Cross-site scripting
Wp Google Map Plugin is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVD6.1
Aug 12, 2019 CVE-2015-9305
Wp Google Map Plugin: Cross-site scripting
Wp Google Map Plugin is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVD6.1
May 14, 2018 CVE-2018-0577
Wp Google Map Plugin: Cross-site scripting
Wp Google Map Plugin is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE5.4
NVD5.4