CVE-2019-10692

Affected software: WordPress WP Google Maps plugin (versions before 7.11.18). Vulnerability details: The REST API implementation in includes/class.rest-api.php does not sanitize field names before a SELECT statement, enabling an SQL injection. Public descriptions and templates consistently state ...

CVE-2023-6777

CVE-2023-6777 affects WP Go Maps (WordPress plugin) up to version 9.0.34, enabling unauthenticated disclosure of the Google API key by embedding it in multiple plugin files. Attackers could use the exposed key to make API requests, potentially exhausting quotas and affecting map functionality. Pu...

CVE-2023-6627

The CVE-2023-6627 entry concerns the WP Go Maps (formerly WP Google Maps) WordPress plugin and a vulnerability in versions prior to 9.0.28. The issue is that most REST API routes are not properly protected, allowing unauthenticated attackers to store malicious HTML/JavaScript on a site via the af...

CVE-2021-24383

The CVE-2021-24383 entry concerns the WordPress WP Google Maps plugin (versions prior to 8.1.12). The vulnerability is an authenticated Stored Cross-Site Scripting (XSS) flaw caused by insufficient sanitization/validation/escaping of the Map Name when output in the Map List on the admin dashboard...

CVE-2019-9912

CVE-2019-9912 affects the WordPress WP Go Maps plugin prior to version 7.10.43. The vulnerability is a Cross-Site Scripting (XSS) via the wp-admin/admin.php PATH_INFO, allowing an attacker to execute arbitrary script in the admin context. Impact can include potential session hijacking or privileg...

CVE-2024-29931

WP Go Maps

CVE-2024-3557

CVE-2024-3557 refers to a Stored Cross-Site Scripting vulnerability in the WordPress plugin WP Go Maps (formerly WP Google Maps) . The weakness is due to insufficient input sanitization and output escaping on user-supplied attributes used by the plugin shortcode wpgmza, affecting versions up to a...

CVE-2024-5994

CVE-2024-5994 affects the WP Go Maps (formerly WP Google Maps) WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) via the Custom JS option in versions up to 9.0.38. It allows authenticated users with contributor-level permissions and above (granted by an administrator) to ...

CVE-2014-7182

The CVE-2014-7182 entry affects the WP Google Maps WordPress plugin, with XSS vulnerabilities in versions prior to 6.0.27. The underlying issue is unsanitized input via the poly_id parameter used by actions edit_poly, edit_polyline, and edit_marker on the wp-google-maps-menu page routed to wp-adm...

CVE-2019-14792

The CVE-2019-14792 entry applies to the WordPress WP Google Maps plugin prior to version 7.11.35. The vulnerability arises from an XSS flaw in the plugin via the wp-admin/ rectangle_name or rectangle_opacity parameters, caused by insufficient input validation/sanitization. Public sources in the c...

CVE-2025-24742

CVE-2025-24742 covers a Cross-Site Request Forgery (CSRF) in the WordPress plugin WP Go Maps (formerly WP Google Maps). Affected are WP Go Maps versions up to and including 9.0.40. The vulnerability enables CSRF on actions performed by authenticated users; no exploitation details are provided in ...

CVE-2022-47595

CVE-2022-47595 describes a path traversal in the WP Go Maps plugin (formerly WP Google Maps) for versions 9.0.15 (fixed in 9.0.16) or apply vendor-provided mitigation as documented. Exploitation details are not provided in the available documents. Other sources corroborate the vulnerability as a ...

CVE-2024-1582

CVE-2024-1582 affects the WordPress plugin WP Go Maps (formerly WP Google Maps). It allows Stored XSS through the plugin’s wpgmza shortcode; exploited via user-supplied attributes due to insufficient input sanitization and output escaping. Affected versions: all prior to and including 9.0.32. Imp...

CVE-2021-36870

The CVE-2021-36870 issue affects WordPress WP Google Maps plugin ≤ 8.1.12. The connected sources describe multiple authenticated persistent XSS vulnerabilities in this plugin, with vulnerable parameters including dataset_name, wpgmza_gdpr_retention_purpose, wpgmza_gdpr_company_name, name, polynam...

CVE-2021-36871

CVE-2021-36871 corresponds to multiple authenticated persistent cross-site scripting (XSS) vulnerabilities in the WordPress WP Google Maps Pro premium plugin (versions ≤ 8.1.11). The issues arise from unsanitized inputs in several vulnerable parameters (e.g., wpgmaps_marker_category_name, &attrib...

CVE-2023-4839

CVE-2023-4839 summary (WP Go Maps for WordPress) The WP Go Maps (WP Google Maps) plugin is affected by a Stored XSS in admin settings, present in versions up to and including 9.0.32. The vulnerability stems from insufficient input sanitization and output escaping, enabling an authenticated attack...