WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 1–40 of 40 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium WP Maps Plugin wp-google-map-plugin Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter ≤ 4.9.8 CVE-2026-13179 Wordfence
7.5 High WP Maps Plugin wp-google-map-plugin Local File Inclusion Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter ≤ 4.9.8 CVE-2026-13456 Wordfence
7.6 High WP Maps Plugin wp-google-map-plugin SQL Injection ≤ 4.9.9 Fixed in 5.0.0 CVE-2026-66618 Patchstack
5.3 Medium WP Go Maps Plugin wp-google-maps Denial of Service Denial of Service Attack No login needed ≤ 10.1.08 Fixed in 10.1.09 CVE-2026-84780 Patchstack
5.4 Medium WP Maps Plugin wp-google-map-plugin Broken Access Control Subscriber+ Unlimited Autoloaded Option Creation < 4.9.8 Fixed in 4.9.8 CVE-2026-18466 WPScan
6.5 Medium WP Maps Plugin wp-google-map-plugin Denial of Service Subscriber+ Denial of Service < 4.9.7 Fixed in 4.9.7 CVE-2026-16265 WPScan
8.8 High WP Maps Plugin wp-google-map-plugin Local File Inclusion Subscriber+ Local File Inclusion < 4.9.7 Fixed in 4.9.7 CVE-2026-16263 WPScan
4.3 Medium WP Maps Plugin wp-google-map-plugin Information Disclosure Sensitive Data Exposure ≤ 4.9.6 Fixed in 4.9.7 CVE-2026-28144 Patchstack
3.7 Low WP Go Maps Plugin wp-google-maps SQL Injection Unauthenticated SQL Injection via Markers REST filter No login needed < 10.1.04 Fixed in 10.1.04 CVE-2026-15381 WPScan
7.1 High WP Google Maps Pro Plugin wp-google-maps-pro Cross-Site Scripting No login needed ≤ 10.1.02 Fixed in 10.1.03 CVE-2026-57767 Patchstack
5.3 Medium WP Go Maps Plugin wp-google-maps Broken Access Control No login needed ≤ 10.1.04 CVE-2026-25466 Patchstack
5.3 Medium WP Go Maps Plugin wp-google-maps Broken Access Control Unauthenticated Arbitrary Record Creation No login needed ≤ 10.1.01 CVE-2026-12238 Wordfence
9.3 Critical WP Maps Plugin wp-google-map-plugin SQL Injection No login needed ≤ 4.9.1 Fixed in 4.9.2 CVE-2026-39492 Patchstack
5.3 Medium WP Go Maps Plugin wp-google-maps Information Disclosure Unauthenticated Sensitive Information Disclosure via Marker ID No login needed < 10.0.10 Fixed in 10.0.10 CVE-2026-8386 WPScan
5.3 Medium WP Go Maps Plugin wp-google-maps Information Disclosure Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback No login needed < 10.0.10 Fixed in 10.0.10 CVE-2026-8385 WPScan
4.4 Medium WP Maps Plugin wp-google-map-plugin Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter ≤ 4.9.4 CVE-2026-9594 Wordfence
7.5 High WP Maps Plugin wp-google-map-plugin Local File Inclusion Subscriber+ Local File Inclusion < 4.9.3 Fixed in 4.9.3 CVE-2026-6381 WPScan
6.1 Medium WP Google Maps Integration Plugin wp-google-maps-integration Cross-Site Scripting Reflected Cross-Site Scripting via 'page' Parameter No login needed ≤ 1.2 CVE-2026-7464 Wordfence
7.5 High WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters Plugin wp-google-map-plugin SQL Injection Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter No login needed ≤ 4.9.1 CVE-2026-2580 Wordfence
6.4 Medium WP Go Maps (formerly WP Google Maps) Plugin wp-google-maps Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings ≤ 10.0.05 CVE-2026-4268 Wordfence
7.5 High WP Maps Plugin wp-google-map-plugin SQL Injection Unauthenticated SQL Injection via 'location_id' Parameter No login needed ≤ 4.9.1 CVE-2026-3222 Wordfence
8.8 High WP Maps Plugin wp-google-map-plugin Local File Inclusion Authenticated (Subscriber+) Limited Local File Inclusion ≤ 4.8.6 CVE-2025-12062 Wordfence
6.4 Medium Best-wp-google-map Plugin best-wp-google-map Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute ≤ 2.1 CVE-2026-1096 Wordfence
5.3 Medium WP Go Maps (formerly WP Google Maps) Plugin wp-google-maps Broken Access Control Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification No login needed ≤ 10.0.04 CVE-2026-0593 Wordfence
6.6 Medium WP Maps Plugin wp-google-map-plugin PHP Object Injection ≤ 4.8.6 Fixed in 4.8.7 CVE-2025-67535 Patchstack
4.3 Medium Advanced Google Maps Plugin wp-google-map-gold Broken Access Control ≤ 5.8.4 Fixed in 5.8.5 CVE-2025-39465 Patchstack
6.5 Medium WP Google Map Plugin wp-google-map SQL Injection Authenticated (Contributor+) SQL Injection ≤ 1.0 CVE-2025-11365 Wordfence
5.4 Medium WP Go Maps (formerly WP Google Maps) Plugin wp-google-maps Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Update No login needed ≤ 9.0.46 CVE-2025-11166 Wordfence
3.5 Low WP Maps Plugin wp-google-map-plugin Cross-Site Scripting Admin+ Stored XSS < 4.7.2 Fixed in 4.7.2 CVE-2025-3504 WPScan
4.5 Medium WP Maps Plugin wp-google-map-plugin Cross-Site Scripting Admin+ Stored XSS < 4.7.2 Fixed in 4.7.2 CVE-2025-3503 WPScan
3.5 Low WP Maps Plugin wp-google-map-plugin Cross-Site Scripting Admin+ Stored XSS < 4.7.2 Fixed in 4.7.2 CVE-2025-3502 WPScan
4.3 Medium WP Go Maps Plugin wp-google-maps Cross-Site Request Forgery No login needed ≤ 9.0.40 Fixed in 9.0.41 CVE-2025-24742 Patchstack
8.8 High WordPress Plugin for Google Maps – WP MAPS Plugin wp-google-map-plugin SQL Injection WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injection ≤ 4.6.1 CVE-2024-2386 Wordfence
6.4 Medium WP Go Maps (formerly WP Google Maps) Plugin wp-google-maps Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 9.0.38 CVE-2024-5994 Wordfence
6.4 Medium WP Go Maps (formerly WP Google Maps) Plugin wp-google-maps Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 9.0.36 CVE-2024-3557 Wordfence
7.1 High WP Go Maps Plugin wp-google-maps Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 9.0.29 Fixed in 9.0.30 CVE-2024-29931 Patchstack
6.4 Medium WP Go Maps (formerly WP Google Maps) Plugin wp-google-maps Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 9.0.32 CVE-2024-1582 Wordfence
4.4 Medium WP Go Maps Plugin wp-google-maps Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 9.0.32 CVE-2023-4839 Wordfence
6.1 Medium WP Go Maps (formerly WP Google Maps) Plugin wp-google-maps Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 9.0.28 CVE-2023-6697 Wordfence
6.1 Medium WP Go Maps Plugin wp-google-maps Cross-Site Scripting Unauthenticated Stored XSS No login needed < 9.0.28 Fixed in 9.0.28 CVE-2023-6627 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only