Plugin security history

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 25 vulnerability records associated with WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters, published between 2015 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

25Total records

0Critical

12High

13Medium

0Low

0Informational

25Patched records

0Currently marked unpatched

2015-04-24First disclosure

2026-06-11Latest disclosure

22 of 25CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2015	5	5 records
2016	1	1 records
2018	1	1 records
2019	2	2 records
2020	1	1 records
2022	1	1 records
2023	2	2 records
2024	1	1 records
2025	4	4 records
2026	7	7 records

Severity Breakdown

Severity	Records	Share
High	12	48%
Medium	13	52%

Vulnerability-Type Breakdown

Cross-Site Scripting

10 records40%

First: 2015. Latest: 2026.

CSRF

7 records28%

First: 2015. Latest: 2023.

SQL Injection

5 records20%

First: 2020. Latest: 2026.

Other

2 records8%

First: 2025. Latest: 2026.

Path Traversal

1 record4%

First: 2026. Latest: 2026.

Patch Status

Patched: 25
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.9.3
4.9.5
4.8.8
4.9.2
4.8.7
4.7.2
4.6.2
4.4.3
4.4.0
4.2.4
4.1.5
4.1.0
4.0.4
3.1.2
2.3.10
3.0.0
2.3.7

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`[*, 4.9.3)`	WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 - Authenticated (Subscriber+) Local File Inclusion	June 11, 2026	4.9.3	High
`*-4.9.4`	WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter	June 5, 2026	4.9.5	Medium
`*-4.8.7`	WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode	April 15, 2026	4.8.8	Medium
`*-4.9.1`	WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection	April 8, 2026	4.9.2	High
`*-4.9.1`	WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter	March 22, 2026	4.9.2	High
`*-4.9.1`	WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter	March 10, 2026	4.9.2	High
`*-4.8.6`	WP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion	February 16, 2026	4.8.7	High
`*-4.8.6`	Maps <= 4.8.6 - Authenticated (Administrator+) PHP Object Injection	November 2, 2025	4.8.7	Medium
`*-4.7.1`	WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting	April 10, 2025	4.7.2	Medium
`*-4.7.1`	WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting	April 10, 2025	4.7.2	Medium
`*-4.7.1`	WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting	April 10, 2025	4.7.2	Medium
`*-4.6.1`	WordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injection	June 28, 2024	4.6.2	High
`*-4.4.2`	WP Google Map Plugin <= 4.4.2 - Cross-Site Request Forgery via delete()	March 13, 2023	4.4.3	Medium
`*-4.3.9`	WP MAPS <= 4.3.9 - Authenticated (Editor+) Stored Cross-Site Scripting	January 20, 2023	4.4.0	Medium
`[*, 4.2.4)`	WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.2.3 - Cross-Site Request Forgery	February 22, 2022	4.2.4	Medium
`*-4.1.4`	WP Google Map Plugin <= 4.1.4 - Authenticated SQL Injection via Orderby	November 25, 2020	4.1.5	High
`[*, 4.1.0)`	WP Google Map Plugin <= 4.0.9 - Cross-Site Request Forgery to PHP Object Injection	September 21, 2019	4.1.0	High
`*-4.0.9`	WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.0.9 - Reflected Cross-Site Scripting	September 21, 2019	4.1.0	Medium
`[*, 4.0.4)`	WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps < 4.0.4 - Cross-Site Scripting	April 27, 2018	4.0.4	Medium
`[*, 3.1.2)`	WP Google Map Plugin <= 3.1.1 - Cross-Site Scripting	July 27, 2016	3.1.2	Medium
`[*, 2.3.10)`	WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery	August 21, 2015	2.3.10	High
`[*, 2.3.10)`	WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery	August 21, 2015	2.3.10	High
`[*, 2.3.10)`	WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery	August 21, 2015	2.3.10	High
`[*, 3.0.0)`	WP Google Map Plugin < 3.0.0 - Cross-Site Request Forgery to Cross-Site Scripting	August 20, 2015	3.0.0	High
`[*, 2.3.7)`	WP Google Map Plugin < 2.3.7 - Reflected Cross-Site Scripting	April 24, 2015	2.3.7	Medium

Selected source records

Latest Records

HighCVE-2026-6381

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 - Authenticated (Subscriber+) Local File Inclusion

Published: June 11, 2026

Affected versions: [*, 4.9.3)
Patched versions: 4.9.3

Original Wordfence record

MediumCVE-2026-9594

WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter

Published: June 5, 2026

Affected versions: *-4.9.4
Patched versions: 4.9.5

Original Wordfence record

MediumCVE-2025-13364

WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode

Published: April 15, 2026

Affected versions: *-4.8.7
Patched versions: 4.8.8

Original Wordfence record

HighCVE-2026-39492

WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection

Published: April 8, 2026

Affected versions: *-4.9.1
Patched versions: 4.9.2

Original Wordfence record

HighCVE-2026-2580

WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter

Published: March 22, 2026

Affected versions: *-4.9.1
Patched versions: 4.9.2

Original Wordfence record

HighCVE-2026-3222

WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter

Published: March 10, 2026

Affected versions: *-4.9.1
Patched versions: 4.9.2

Original Wordfence record

HighCVE-2025-12062

WP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion

Published: February 16, 2026

Affected versions: *-4.8.6
Patched versions: 4.8.7

Original Wordfence record

MediumCVE-2025-67535

Maps <= 4.8.6 - Authenticated (Administrator+) PHP Object Injection

Published: November 2, 2025

Affected versions: *-4.8.6
Patched versions: 4.8.7

Original Wordfence record

Highest-Severity Records

HighCVE-2024-2386

WordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injection

Published: June 28, 2024

Affected versions: *-4.6.1
Patched versions: 4.6.2

Original Wordfence record

HighCVE-2025-12062

WP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion

Published: February 16, 2026

Affected versions: *-4.8.6
Patched versions: 4.8.7

Original Wordfence record

HighCVE-2015-9309

WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery

Published: August 21, 2015

Affected versions: [*, 2.3.10)
Patched versions: 2.3.10

Original Wordfence record

High

WP Google Map Plugin <= 4.0.9 - Cross-Site Request Forgery to PHP Object Injection

Published: September 21, 2019

Affected versions: [*, 4.1.0)
Patched versions: 4.1.0

Original Wordfence record

HighCVE-2015-9307

WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery

Published: August 21, 2015

Affected versions: [*, 2.3.10)
Patched versions: 2.3.10

Original Wordfence record

HighCVE-2015-9308

WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery

Published: August 21, 2015

Affected versions: [*, 2.3.10)
Patched versions: 2.3.10

Original Wordfence record

HighCVE-2026-39492

WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection

Published: April 8, 2026

Affected versions: *-4.9.1
Patched versions: 4.9.2

Original Wordfence record

HighCVE-2026-6381

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 - Authenticated (Subscriber+) Local File Inclusion

Published: June 11, 2026

Affected versions: [*, 4.9.3)
Patched versions: 4.9.3

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory