WPGMaps vulnerabilities

CVEs per yearBy the year they were published

1. 20247
2. 20253
3. 20265

Newest CVEs

• CVE-2026-84780

  WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability

  WPGMaps · WP Go Maps

  Medium5.3
• CVE-2026-25466

  WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability

  WPGMaps · WP Go Maps

  Medium5.3
• CVE-2026-12238

  WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation

  wpgmaps · WP Go Maps – Google Map, OpenStreetMap, Leaflet Map

  Medium5.3
• CVE-2026-4268

  WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings

  wpgmaps · WP Go Maps (formerly WP Google Maps)

  Medium6.4
• CVE-2026-0593

  WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification

  wpgmaps · WP Go Maps (formerly WP Google Maps)

  Medium5.3
• CVE-2025-11703

  WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning

  wpgmaps · WP Go Maps (formerly WP Google Maps)

  Medium5.3
• CVE-2025-11166

  WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update

  wpgmaps · WP Go Maps (formerly WP Google Maps)

  Medium5.4
• CVE-2025-24742

  WordPress WP Google Maps plugin <= 9.0.40 - Cross Site Request Forgery (CSRF) vulnerability

  WPGMaps · WP Go Maps

  Medium4.3
• CVE-2024-5994

  WP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting

  wpgmaps · WP Go Maps (formerly WP Google Maps)

  Medium6.4
• CVE-2024-3557

  WP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  wpgmaps · WP Go Maps (formerly WP Google Maps)

  Medium6.4