WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure

WP Go Maps WordPress plugin 10.0.10 contains an information disclosure vulnerability caused by improper enforcement of marker approval filter in admin-ajax fallback for datatables route, letting unauthenticated visitors retrieve unapproved marker records. id: CVE-2026-8385 info: name: WordPress W...

WP Go Maps (formerly WP Google Maps) < 9.0.29 - Cross-Site Scripting

The WP Go Maps formerly WP Google Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the map id parameter in all versions up to, and including, 9.0.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure

WP Go Maps WordPress plugin 10.0.10 contains an information disclosure vulnerability caused by lack of approval-state filtering on the public single-marker REST endpoint, letting unauthenticated users access unapproved marker records including PII and geographic coordinates, exploit requires no...

WP Go Maps <= 9.0.29 - Cross-Site Scripting

WP Go Maps formerly WP Google Maps plugin for WordPress versions before 9.0.30 is vulnerable to Reflected Cross-Site Scripting via the 'mapid' parameter in the admin map edit page. id: CVE-2024-29931 info: name: WP Go Maps = 9.0.29 - Cross-Site Scripting author: Shivam Kamboj severity: medium...

CVE-2026-84780

Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...

CVE-2026-84780 WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...

CVE-2026-84780 WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...

CVE-2026-84780

WP Go Maps is a WordPress plugin affected by an unauthenticated Denial of Service vulnerability in versions ≤ 10.1.08 , as reported by researcher Asim Alshaya via Patchstack. The CVSS 3.1 score is 5.3 (Medium) with a network attack vector, low complexity, and no privileges required, resulting in ...

EUVD-2026-69942

Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...

WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by Asim Alshaya in WordPress Plugin WP Go Maps versions = 10.1.08...

CVE-2026-84780: Allocation of Resources Without Limits or Throttling

Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...

PT-2026-84704

Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...

WordPress WP Go Maps plugin < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID vulnerability

Unauthenticated Sensitive Information Disclosure via Marker ID vulnerability discovered by Sudhanshu Chauhan RedHunt Labs in WordPress Plugin WP Go Maps versions 10.0.10...

PT-2026-66717

Name of the Vulnerable Software and Affected Versions WP Go Maps versions prior to 10.1.04 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL query. SQL injection is a techniqu...

CVE-2026-15381: Improper Neutralization of Special Elements used in an SQL Command

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-25466

CVE-2026-25466 affects the WordPress WP Go Maps plugin (vulnerable:

CVE-2026-25466: Missing Authorization

Unauthenticated Broken Access Control in WP Go Maps = 10.1.04 versions...

CVE-2026-12238

The WP Go Maps WordPress plugin (up to version 10.1.01) is vulnerable to an authorization bypass that allows unauthenticated attackers to create arbitrary records in plugin tables (maps, markers, circles, polygons, polylines, rectangles, and point labels) by supplying a WPGMZA-namespaced CRUD-bac...

CVE-2026-12238: Missing Authorization

The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.1.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers ...

CVE-2026-8386

The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address...