API KEY for Google Maps

API KEY for Google Maps has one disclosed vulnerability in the WordSec catalog, all reported in 2022; it is fixed as of October 2026. Their average CVSS score is 5.4, and the most serious one scores 5.4 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for API KEY for Google Maps has a vendor fix available, so running the current release closes it.

API KEY for Google Maps is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all API KEY for Google Maps vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.4CVE-2022-29453

API KEY for Google Maps <= 1.2.1 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

1 records
API KEY for Google Maps banner
Latestv1.2.16

API KEY for Google Maps

Stiofan

Author

Stiofan

4.9(55)
98/100
Last Updated
2026-09-30 (28d ago)
Active Installs
30,000+
Downloads
860,360
Requires WP
6.0+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2016-07-01 (11y ago)

Many themes and plugins load Google Maps without an API key, or without a setting to enter one. Google requires an API key for every Maps JavaScript API request, so these maps fail with “This page can’t load Google Maps correctly” or show a “For development purposes only” watermark. API KEY for Google Maps fixes this without touching theme or plugin code. Enter your key once and the plugin adds it to every Google Maps JavaScript API script enqueued on the site. Features Adds your API key to Google Maps JavaScript API scripts enqueued by any theme or plugin. Replaces an outdated or different key already present in the script URL with your own. Adds the callback parameter Google has required since January 2023, fixing the JavaScript error Loading the Google Maps JavaScript API without a callback is not supported. Works on the front end of your site and in the WordPress admin. One-click Generate API Key button that opens the Google Cloud Console with the Maps APIs selected. Quick link to a free tool that checks your site for Google Maps API key errors. Lightweight: a single settings field and a tiny inline script. The saved key is removed when you delete the plugin. How to use Activate the plugin and go to Settings > Google API KEY. Click Generate API Key (you must be signed in to your Google account), or paste a key you already have. Click Save Changes. Your maps now load with your key. Requirements and tips The theme or plugin must load Google Maps the standard WordPress way (with wp_enqueue_script()). Scripts that are hard-coded into templates or injected by JavaScript can not be changed. Browser API keys are visible in your page source. In the Google Cloud Console, restrict your key to your website’s domain (HTTP referrers) and to the Maps APIs you use. For developers When the Google Maps API has loaded, the plugin sets window.rgmkGoogleMapsCallback to true and triggers the jQuery event rgmkGoogleMapsLoad on document. Use the rgmk_google_map_callback_script filter to change the callback script. The plugin was created by the GeoDirectory team. Security To report a security vulnerability, please review our vulnerability disclosure policy.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C