CVE-2026-9594

Name of the Vulnerable Software and Affected Versions WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters versions prior to 4.9.5

Description The plugin is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping within the location messages parameter. Authenticated attackers with administrator-level access or those assigned the wpgmp manage location capability can inject arbitrary web scripts into pages. These scripts execute whenever a user visits the affected page.

Recommendations Update the plugin to version 4.9.5 or later. As a temporary mitigation, restrict the wpgmp manage location capability to only trusted administrative users.