CVE-2026-13179

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes ...

EUVD-2026-86600

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-13179

The WP Maps plugin for WordPress (versions up to and including 4.9.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the shapes_values parameter. The root cause is insufficient input sanitization and output escaping . Authenticated attackers with subscriber-level access or higher can inj...

CVE-2026-13179 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes ...