WP Geo
WP Geo has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for WP Geo has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Muhammad Yudha - DJ. WP Geo is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.4.21.
CVE-2025-62904WP Geo <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

WP Geo
Author
Ben Huson
Important Note About WP Geo 3.3+ This update now uses Google Maps API v3. While it should continue to work OK it you have simply installed and are using a previous version of WP Geo, if you have customised your templates or used any filters you may need to update your code to work with this version of Google’s API. Please submit any bugs or issues here… When editing a post or page, you will be able to set a physical location for that post and easily embed a Google map into your post. You can select the location by: Clicking on the map of the world to position the point. Searching for a location, town, city or address. Entering the latitude and longitude. The WP Geo location selector is styled to fit seamlessly into the latest version of the WordPress admin. More information can be found at http://www.wpgeo.com/. Features Custom marker title setting per post. Custom zoom and map type per post. Supports custom post types. Widget zoom option. Default Map Location setting. Geo Meta Tags Markers links to posts Settings for default controls Custom Markers Sidebar Widget GeoRSS points in feeds. Set default map zoom level. Show post maps on category and archive pages. Set default width and height for maps Shortcode [wp_geo_map] to insert map within your post Select your preferred map type Select wether to show your map at the top or bottom of posts (or not at all) Set a location by clicking on a map or Set a location by searching for a location, town, city or address or Set a location by entering the latitude and longitude Languages WP Geo is currently available in the following languages: Belorussian (by Ilyuha) Bulgarian (by Roman Rachkov) Chinese, Simplified (by Steen Chow) Croatian (by Andrija Papec) Danish (by Georg) Dutch (by Davey IJzermans) English (default) French (by Alain Messin) German (by Ivan Graf) Italian (by Diego Pierotto) Russian (by Fat Cower) Serbian (by Borisa Djuraskovic – Web Hosting Hub) Spanish (by Alberto) Turkish (by Mehmet HAKAN, WPsitesi)
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C