CVE-2026-13179
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shapes_values parameter in all versions up to and including 4.9.8 due to insufficient input sanitization and output escaping. The fc-call-nonce is exposed to all frontend visitors, and the secondary _wpnonce check can be bypassed by omitting the parameter.
Risk Assessment
An authenticated attacker with subscriber-level access can inject arbitrary web scripts that execute whenever a user accesses an injected page.
Recommendation
Update the WP Maps plugin to a version newer than 4.9.8 that fixes the Stored XSS vulnerability in the shapes_values parameter.
Other vulnerabilities in WP Maps
See all- CVE-2026-66618High
The WordPress plugin WP Maps in versions up to 4.9.9 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.
- CVE-2026-39492Critical
There is an unauthenticated SQL injection vulnerability in WP Maps versions up to 4.9.1.
- CVE-2026-18466Medium
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check nor validate a nonce in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each loaded on every page request.
- CVE-2026-16265Medium
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
- CVE-2026-16263High
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.
- CVE-2026-28144Medium
The WP Maps plugin for WordPress (versions up to and including 4.9.6) has an insertion of sensitive information into sent data vulnerability. It allows retrieving embedded sensitive data.
- CVE-2026-9594Medium
The WP Maps plugin for WordPress up to version 4.9.4 contains a Stored XSS vulnerability via the 'location_messages' parameter. Attackers with administrator privileges (or lower if granted) can inject scripts that execute when users access the page.
Original NVD description (English source)
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapes_values Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fc-call-nonce nonce required by the endpoint is exposed to all frontend visitors who view a map page via window.wpgmp_local.nonce, enabling any authenticated subscriber to read the nonce and craft a valid request; additionally, the secondary _wpnonce check in the drawing handler can be bypassed by simply omitting the _wpnonce parameter from the request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS