CVE Database /
CVE-2025-13364
CVE · Medium
CVE-2025-13364 — WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters [wp-google-map-plugin] < 4.8.8
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-13364
|
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters [wp-google-map-plugin] < 4.8.8 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 4.8.8
|
4.8.8 |
2026-04-15 |
—
|
CVE-2025-13364
The WP Maps plugin contains a security flaw affecting all versions up to 4.8.7. The vulnerability stems from inadequate filtering of user-submitted data passed through the 'put_wpgm' shortcode, allowing malicious scripts to be embedded in pages that can execute when visited by users. Authorized attackers with contributor privileges or higher can exploit this weakness to inject unwanted code on affected sites.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings