CVE-2026-9594
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The WP Maps plugin for WordPress up to version 4.9.4 contains a Stored XSS vulnerability via the 'location_messages' parameter. Attackers with administrator privileges (or lower if granted) can inject scripts that execute when users access the page.
Risk Assessment
An attacker can inject malicious scripts that execute in users' browsers, potentially leading to session theft or redirects.
Recommendation
Update the plugin to the latest version and restrict location management permissions to trusted users only.
Other vulnerabilities in WP Maps
See all- CVE-2026-66618High
The WordPress plugin WP Maps in versions up to 4.9.9 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.
- CVE-2026-39492Critical
There is an unauthenticated SQL injection vulnerability in WP Maps versions up to 4.9.1.
- CVE-2026-13179Medium
The WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shapes_values parameter in all versions up to and including 4.9.8 due to insufficient input sanitization and output escaping. The fc-call-nonce is exposed to all frontend visitors, and the secondary _wpnonce check can be bypassed by omitting the parameter.
- CVE-2026-18466Medium
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check nor validate a nonce in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each loaded on every page request.
- CVE-2026-16265Medium
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
- CVE-2026-16263High
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.
- CVE-2026-28144Medium
The WP Maps plugin for WordPress (versions up to and including 4.9.6) has an insertion of sensitive information into sent data vulnerability. It allows retrieving embedded sensitive data.
- CVE-2025-13364Medium
The WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'put_wpgm' shortcode in all versions up to and including 4.8.7. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes.
- CVE-2025-67535Medium
The WP Maps plugin (wp-google-map-plugin) by Flipper Code is vulnerable to Deserialization of Untrusted Data, allowing Object Injection. This issue affects versions up to and including 4.8.6.
Original NVD description (English source)
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'location_messages' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to hold the custom wpgmp_manage_location capability, which is granted to administrators by default but can be assigned to lower-privileged roles via the plugin's Permissions screen.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS