WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters Plugin Vulnerability (CVE-2026-9594)

Security Alert Summary

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the location_messages parameter in all versions up to and including 4.9.4. Authenticated users with the wpgmp_manage_location capability (granted to administrators by default) can inject scripts that execute when other users view the affected page.

CVE Details

• CVE ID: CVE-2026-9594
• Affected component: WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress
• Affected versions: all versions up to and including 4.9.4
• Published: June 6, 2026 at 5:16:29 AM
• Last modified: June 6, 2026 at 5:16:29 AM
• CVSS v3.1: Base score 4.4, MEDIUM; Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
• Attack details (from CVSS): Attack Vector: Network; Attack Complexity: High; Privileges Required: High; User Interaction: None; Scope: Changed
• Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
• Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation/Stored Cross-Site Scripting)

Technical Details

This vulnerability is a stored cross-site scripting issue caused by insufficient input sanitization and output escaping for the location_messages parameter. An authenticated user who possesses the custom wpgmp_manage_location capability can save crafted input that contains arbitrary script code. That code is stored by the plugin and rendered in pages where the stored value is output without proper escaping, causing the script to execute in the browser of any user who visits the injected page.

The capability wpgmp_manage_location is granted to administrators by default but can be assigned to lower-privileged roles via the plugin’s Permissions screen; exploitation therefore depends on who has that capability on the site. The vulnerability does not require user interaction to trigger once the malicious content is stored and viewed.

How This Could Impact Your Website

In a typical site setup you might have a site owner (administrator), internal staff (editors or managers), and external contractors or contributors. If an account with the wpgmp_manage_location capability is compromised or misused, an attacker could store a script that runs when other staff or visitors view the affected page. Practical consequences include exposure of session data or user-identifying information accessible in the browser, and an increased risk of targeted phishing or social-engineering campaigns against staff whose accounts or email addresses are visible on the site.

The confidentiality and integrity impacts are assessed as low by the CVSS vector, but stored XSS can be leveraged to perform actions in the context of an authenticated user or to harvest data reachable via the browser. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

• Update the affected plugin as soon as a patched version is available.
• Review and reduce unnecessary user roles, and remove the wpgmp_manage_location capability from accounts that do not need it.
• Enforce strong passwords and enable two-factor authentication for editors and administrators.
• Remove unused or unmaintained plugins from your site.
• Monitor site activity and logs for unusual behavior, especially changes to location entries or other plugin-managed content.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.2/modules/location/model.location.php#L299
• https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.2/modules/shortcode/views/put-wpgmp.php#L632
• https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/modules/location/model.location.php#L299
• https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/modules/shortcode/views/put-wpgmp.php#L632
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3550683%40wp-google-map-plugin&new=3550683%40wp-google-map-plugin&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d082c6e6-a18a-44e2-9478-7189f9777198?source=cve