CVE-2026-125824 · Package
NO FIX YET
The WP Go Maps (wp-google-maps) WordPress plugin fails to neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can store malicious content in the plugin can run scripts in other visitors' browsers.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the WP Go Maps (wp-google-maps) WordPress plugin at version 10.1.10 or earlier are exposed. The risk depends on who can enter map data that is later shown to visitors; sites where only trusted administrators edit maps carry less exposure. unknown for whether a newer version is patched.
Not affected if plugin-not-installed, version-above-10.1.10
Who cares self-hosted, wordpress, wp-go-maps
wp plugin get wp-google-maps --field=version10.1.10No fix yet, per the sources.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.