
WP Go Maps (formerly WP Google Maps) Security & Risk Analysis
wordpress.org/plugins/wp-google-mapsThe easiest to use Google maps plugin! Create a custom Google map, map block, store locator or map widget with high quality markers containing categor …
Is WP Go Maps (formerly WP Google Maps) Safe to Use in 2026?
Generally Safe
Score 86/100WP Go Maps (formerly WP Google Maps) has a strong security track record. Known vulnerabilities have been patched promptly.
The wp-google-maps plugin, version 10.0.05, presents a significant security risk due to a combination of concerning static analysis findings and a history of numerous vulnerabilities. While it employs prepared statements for a majority of its SQL queries and shows a moderate level of output escaping, the high number of unprotected AJAX handlers (16 out of 25) is a major red flag. This directly exposes a substantial portion of the plugin's functionality to unauthenticated attackers, potentially allowing them to trigger various malicious actions.
The taint analysis further exacerbates these concerns, revealing 19 high-severity flows with unsanitized paths, indicating a strong likelihood of path traversal or similar vulnerabilities. The presence of the `unserialize` function is another critical indicator of potential remote code execution risks if not handled with extreme care and proper sanitization. Coupled with the plugin's historical pattern of 22 known CVEs, including a critical and a high-severity one, this plugin should be treated with extreme caution.
While the plugin has no currently unpatched CVEs, the sheer volume and types of past vulnerabilities, such as SQL Injection, XSS, CSRF, and Path Traversal, suggest recurring security flaws. The last vulnerability reported in 2026 indicates active development and patching, which is a positive sign. However, the overall picture suggests a plugin that, despite some good practices, has a history of significant security weaknesses and currently exhibits critical exposure points that require immediate attention and remediation.
Key Concerns
- Large number of unprotected AJAX handlers
- High severity taint flows with unsanitized paths
- Presence of unserialize function
- History of 22 known CVEs
- Past critical severity CVE
- Past high severity CVE
- History of SQL Injection vulnerabilities
- History of Path Traversal vulnerabilities
- History of Cross-Site Scripting vulnerabilities
- History of Missing Authorization vulnerabilities
- Bundled library (DataTables) not analyzed for version/patch status
WP Go Maps (formerly WP Google Maps) Security Vulnerabilities
CVEs by Year
Severity Breakdown
22 total CVEs
WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification
Google Maps <= 9.0.47 - Unauthenticated Stored Cross-Site Scripting
WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning
WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update
WP Go Maps <= 9.0.40 - Cross-Site Request Forgery
WP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting
WP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WP Google Maps <= 9.0.29 - Reflected Cross-Site Scripting
WP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Service
WP Go Maps <= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site Scripting
WP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting
WP Google Maps <= 9.0.27 - Unauthenticated Stored Cross-Site Scripting via REST API
WP Go Maps <= 9.0.15 - Authenticated (Admin+) Directory Traversal
WP Google Maps <= 8.1.12 - Authenticated Stored Cross-Site Scripting
WP Google Maps <= 8.1.11 - Authenticated Stored Cross-Site Scripting
WP Go Maps (formerly WP Google Maps) <= 7.11.17 - SQL Injection
WP Google Maps <= 7.11.34 - Cross-Site Request Forgery to Cross-Site Scripting
WP Google Maps <= 7.11.27 - Cross-Site Request Forgery
WP Google Maps < 7.10.43 - Reflected Cross-Site Scripting
WP Google Maps <= 6.3.14 - Stored Cross-Site Scripting
WP Google Maps <= 6.0.26 - Reflected Cross-Site Scripting
WP Go Maps (formerly WP Google Maps) Code Analysis
Dangerous Functions Found
Bundled Libraries
SQL Query Safety
Output Escaping
Data Flow Analysis
WP Go Maps (formerly WP Google Maps) Attack Surface
AJAX Handlers 25
Shortcodes 2
WordPress Hooks 108
Maintenance & Trust
WP Go Maps (formerly WP Google Maps) Maintenance & Trust
Maintenance Signals
Community Trust
WP Go Maps (formerly WP Google Maps) Alternatives
Easy Google Maps
google-maps-easy
Google Maps with markers, locations and clusterization, KML layers and filters. Custom Google map markers with text, images, videos, links.
Map Block for Google Maps
map-block-gutenberg
Map block for Gutenberg editor powered by Google Maps. Simple. Fast. Just a map block.
WP Map Block – Gutenberg Map Block for Google Map and OpenStreet Map by aBlocks
wp-map-block
No API key is required to launch Google Maps & OpenStreetMap.
Maps Plugin using Google Maps for WordPress – WP Google Map
gmap-embed
Google Map plugin for WordPress is very Simple, light-weight and Easy to use Google Custom Map with markers in Posts, Pages, Sidebar as shortcode.
WP Go Maps Block
wp-go-maps-block
The easiest-to-use Google Maps plugin is now available as a standalone map block! Create custom Google maps or OpenLayers maps with high-quality marke …
WP Go Maps (formerly WP Google Maps) Developer Profile
2 plugins · 303K total installs
How We Detect WP Go Maps (formerly WP Google Maps)
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/wp-google-maps/wp-google-maps.js/wp-content/plugins/wp-google-maps/wp-google-maps.css/wp-content/plugins/wp-google-maps/css/wpgmaps.css/wp-content/plugins/wp-google-maps/css/wpgmaps-legacy.css/wp-content/plugins/wp-google-maps/css/wpgmaps-editor.css/wp-content/plugins/wp-google-maps/js/wpgmaps.js/wp-content/plugins/wp-google-maps/js/wpgmaps-editor.js/wp-content/plugins/wp-google-maps/js/wpgmaps-frontend.js+9 more/wp-content/plugins/wp-google-maps/wp-google-maps.js/wp-content/plugins/wp-google-maps/js/wpgmaps.js/wp-content/plugins/wp-google-maps/js/wpgmaps-frontend.js/wp-content/plugins/wp-google-maps/js/wpgmaps-shortcode.jswp-google-maps/wp-google-maps.js?ver=wp-google-maps/css/wpgmaps.css?ver=wp-google-maps/js/wpgmaps.js?ver=wp-google-maps/js/wpgmaps-frontend.js?ver=wp-google-maps/js/wpgmaps-shortcode.js?ver=HTML / DOM Fingerprints
wpgmaps_containerwpgmaps_mapwpgmaps_info_windowwpgmaps_markerwpgmaps_directions_panelwpgmaps_directions_formwpgmaps_store_locator_resultswpgmaps_store_locator_map+1 more<!-- WP Go Maps - Start Map --><!-- WP Go Maps - End Map --><!-- WP Go Maps - Map ID:<!-- WP Go Maps - Marker ID:+2 moredata-wpgmaps-map-iddata-wpgmaps-marker-iddata-wpgmaps-shortcode-optionsdata-wpgmaps-latdata-wpgmaps-lngwpgmapswpgmaps_objectswpgmaps_marker_datawpgmaps_settingswpgmaps_shortcode_varsWPGMaps/wp-json/wpgmaps/v1/maps//wp-json/wpgmaps/v1/markers//wp-json/wpgmaps/v1/shapes/[wpgmza id="[wpgmaps id="[best-google-maps id="[cp-maps id="