Wp Maps
Wp Maps has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 7.5, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Path Traversal, behind 1 of the records (100%).
The one issue recorded for Wp Maps has a vendor fix available, so running the current release closes it.
All of these findings were reported by Jakub Herman. Wp Maps is installed on roughly 30 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.5.33.
CVE-2026-16263Maps <= 4.9.6 - Authenticated (Subscriber+) Local File Inclusion
Read the full analysisVulnerability Records

Wp Maps
Author
mimo
This plugin gives you the possibility to easily integrate Google Maps in your site with a couple of clicks. Just set your locations and show your maps easily in your pages and posts. Show unlimited maps per category or post ID. Organize locations in categories to show different Google Maps per Category. Map Icons font: Visit Map Icons font to see the icons and icon types you have available. The Map Icon library have been integrated in this plugin to show beautiful maps. Visit Map Icons Locations Post Type: To save your locations, with images and descriptions and show them in a map. With this Google Maps Plugin you can: Create, edit and delete your custom locations Add as many locations as you need Easy to use, no coding required 100% Responsive Maps Google Maps Streetview supported UTF-8 character support Add colors, icons, icon type, images, links and descriptions to map markers Organize locations in categories Create several maps showing different locations Create Routes Usage instructions Set category icons and colors in plugin Settings, Goto Settings/Wp Maps Use [wpmaps] shortcode to show the map with all locations(all posts or products locations), using shortcode: [wpmaps post_id=”id of location post”] Shows only one post location [wpmaps category_slug=”slug”] Shows locations in posts from one category Shortcode atributtes: id = Id of Map custom Post type(to take it style), default empty post_id = Id of post to show(only one post), default empty category_slug = slug of category to show, default empty posts_per_page = Number of posts to show(only posts with locations), default -1 post_type = post or product, default locations post that is called ‘wpmaps_location’ Developer instructions You can pass your options to the opstions array: $args = array( 'post_id' => '', 'category_slug' => '', 'posts_per_page' => '', 'post_type' => '', ); if ( class_exists('WpMaps_Display') ) WpMaps_Display::display_map( $args );</br> Find plugin and issues solved at http://mimo.studio or fork it on Github at https://github.com/mimomedia/wp-maps
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C