WP Go Maps (formerly WP Google Maps) Plugin Vulnerabilities

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for WP Go Maps (formerly WP Google Maps) so operators can quickly confirm whether a disclosed issue maps to the installed slug and version range.

Patch Visibility

23 records include a published patch path.

Severity Mix

1 critical and 1 high severity finding.

Reference Workflow

Jump from the hub into the full report when you need remediation notes, CVSS vector details, or source references.

Known Vulnerabilities

Reports for WP Go Maps (formerly WP Google Maps)

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-4268

WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpgmza_custom_js’ parameter in all versions up to, and including, 10.0.05 due to insufficient input sanitization and output escaping and missing capability check in...

Published

Mar 17, 2026

Patched Release

10.0.06

Affected Versions

Versions up to 10.0.05

Next Step

Update to 10.0.06 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2026-0593

WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the processBackgroundAction() function in all versions up to, and including, 10.0.04. This makes it possible for authenticated att...

Published

Jan 24, 2026

Patched Release

10.0.05

Affected Versions

Versions up to 10.0.04

Next Step

Update to 10.0.05 or newer if supported.

Open Full Report Open CVE Reference

Plugin High Patched: Yes CVE-2025-11307

Google Maps <= 9.0.47 - Unauthenticated Stored Cross-Site Scripting

The Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 9.0.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...

Published

Oct 21, 2025

Patched Release

9.0.48

Affected Versions

Versions up to 9.0.47

Next Step

Update to 9.0.48 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2025-11703

WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48. This is due to the plugin not serving cached data from server-side responses and instead relying on user-input. This makes it possible for...

Published

Oct 17, 2025

Patched Release

9.0.49

Affected Versions

Versions up to 9.0.48

Next Step

Update to 9.0.49 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2025-11166

WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 9.0.46. This is due to the plugin exposing state-changing REST actions through an AJAX bridge without proper CSRF token validatio...

Published

Oct 08, 2025

Patched Release

9.0.47

Affected Versions

Versions up to 9.0.46

Next Step

Update to 9.0.47 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2025-24742

WP Go Maps <= 9.0.40 - Cross-Site Request Forgery

The WP Go Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 9.0.40. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via...

Published

Jan 24, 2025

Patched Release

9.0.41

Affected Versions

Versions up to 9.0.40

Next Step

Update to 9.0.41 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2024-5994

WP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions up to, and including, 9.0.38. This makes it possible for authenticated attackers that have been explicitly granted permissions by an adminis...

Published

Jun 13, 2024

Patched Release

9.0.39

Affected Versions

Versions up to 9.0.38

Next Step

Update to 9.0.39 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2024-3557

WP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpgmza shortcode in all versions up to, and including, 9.0.36 due to insufficient input sanitization and output escaping on user supplied attributes. This m...

Published

May 23, 2024

Patched Release

9.0.37

Affected Versions

Versions up to 9.0.36

Next Step

Update to 9.0.37 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2024-29931

WP Google Maps <= 9.0.29 - Reflected Cross-Site Scripting

The WP Google Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 9.0.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

Published

Mar 25, 2024

Patched Release

9.0.30

Affected Versions

Versions up to 9.0.29

Next Step

Update to 9.0.30 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2023-6777

WP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Service

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 9.0.34 due to the plugin adding the API key to several plugin files. This makes it possible for unauthenticated attackers to obtain...

Published

Mar 18, 2024

Patched Release

9.0.35

Affected Versions

Versions up to 9.0.34

Next Step

Update to 9.0.35 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2024-1582

WP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgmza' shortcode in all versions up to, and including, 9.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This...

Published

Mar 12, 2024

Patched Release

9.0.33

Affected Versions

Versions up to 9.0.32

Next Step

Update to 9.0.33 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2023-4839

WP Go Maps <= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site Scripting

The WP Go Maps for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissio...

Published

Mar 12, 2024

Patched Release

9.0.33

Affected Versions

Versions up to 9.0.32

Next Step

Update to 9.0.33 or newer if supported.

Open Full Report Open CVE Reference

WP Go Maps (formerly WP Google Maps) Vulnerabilities

What this page helps you verify fast

Reports for WP Go Maps (formerly WP Google Maps)