WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters

WordPress map plugin for Google Maps, OpenStreetMap & Mapbox with store locator, filterable listings & custom markers.

27Reported vulnerabilities
8.8Highest CVSS score
4.9.8Latest version
60,000+Active installs

What to do now

Update WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters to 4.9.8 or later. 27 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 14, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2025-12062 High 8.8 0.7% 4.8.6 and earlier 4.8.7 February 16, 2026
CVE-2024-2386 High 8.8 0.5% 0 to 4.6.1 (inclusive)
0 to 4.6.1 (inclusive)		 4.6.2 June 29, 2024
CVE-2023-28172 High 8.8 0.3% 4.4.2 and earlier 4.4.3 November 12, 2023
CVE-2015-9309 High 8.8 0.7% Before 2.3.10 2.3.10 August 14, 2019
CVE-2015-9308 High 8.8 0.7% Before 2.3.10 2.3.10 August 14, 2019
CVE-2015-9307 High 8.8 0.7% Before 2.3.10 2.3.10 August 14, 2019
WF-a5ba9285-9f41-44dd-83c7-e9c377d9de51 High 8.8 — Before 4.1.0 4.1.0 September 21, 2019
CVE-2026-6381 High 7.5 0.5% Before 4.9.3 4.9.3 June 11, 2026
CVE-2026-39492 High 7.5 0.4% 4.9.1 and earlier 4.9.2 April 8, 2026
CVE-2026-2580 High 7.5 0.4% 0 to 4.9.1 (inclusive) 4.9.2 March 23, 2026
CVE-2026-3222 High 7.5 0.4% 0 to 4.9.1 (inclusive) 4.9.2 March 11, 2026
WF-01105d96-e181-4228-b785-074a4b49ce18 High 7.1 — Before 3.0.0 3.0.0 August 20, 2015
CVE-2025-67535 Medium 6.6 0.4% 0 to 4.8.6 (inclusive) 4.8.7 December 9, 2025
CVE-2026-16265 Medium 6.5 0.2% 4.9.6 and earlier 4.9.7 August 3, 2026
CVE-2025-13364 Medium 6.4 0.3% 4.8.7 and earlier 4.8.8 April 15, 2026
CVE-2015-9305 Medium 6.1 1.0% Before 2.3.7 2.3.7 August 12, 2019
CVE-2016-10878 Medium 6.1 1.0% Before 3.1.2 3.1.2 August 12, 2019
WF-4186fe8d-ca09-4b82-9500-7b16bd10b044 Medium 6.1 — 4.0.9 and earlier 4.1.0 September 21, 2019
CVE-2018-0577 Medium 5.4 0.8% Before 4.0.4 4.0.4 May 14, 2018
CVE-2023-23878 Medium 5.4 0.4% Before 4.4.0 4.4.0 April 4, 2023
CVE-2022-25600 Medium 5.4 0.6% Before 4.2.4 4.2.4 February 22, 2022
CVE-2026-9594 Medium 4.4 0.3% 0 to 4.9.4 (inclusive) 4.9.5 June 6, 2026
CVE-2025-3504 Medium 4.4 0.3% 4.7.1 and earlier 4.7.2 April 10, 2025
CVE-2025-3502 Medium 4.4 0.3% 4.7.1 and earlier 4.7.2 April 10, 2025
CVE-2025-3503 Medium 4.4 0.3% 4.7.1 and earlier 4.7.2 April 10, 2025
CVE-2026-18466 Medium 4.3 0.2% Before 4.9.8 4.9.8 August 21, 2026
CVE-2026-28144 Medium 4.3 0.2% 4.9.6 and earlier 4.9.7 July 31, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.