Stored Cross-Site Scripting Vulnerability in WP Maps Plugin from WordPress
CVE-2026-9594

4.4MEDIUM

Key Information:

Vendor

WordPress
Status
WP Maps – Google Maps,openstreetmap,mapbox,store Locator,listing,directory & Filters
Vendor
CVE Published:
6 June 2026

What is CVE-2026-9594?

The WP Maps plugin for WordPress is subject to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in the 'location_messages' parameter. This issue affects all versions of the plugin up to and including 4.9.4. Authenticated attackers, particularly those with administrator-level access or custom permissions, can exploit this vulnerability to inject malicious web scripts into web pages. Once injected, these scripts run each time a user accesses the compromised page, potentially leading to unauthorized access or data manipulation.

Affected Version(s)

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters 0 <= 4.9.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-google-map-...
https://plugins.trac.wordpress.org/browser/wp-google-map-...

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yousef Alraddadi
.