Easy Google Maps
google-maps-easy · plugin
Known security vulnerabilities for Easy Google Maps. Find out in seconds which version runs on your site with WP Lens.
9 known vulnerabilities
1 critical · 6 exploitable without logging in · latest Sep 30, 2026
Listed on wordpress.org · latest 1.15.1 · last updated Sep 29, 2026 · 20K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- Critical 9.8
CVE-2026-73366unauthenticated≤ 1.13.0
WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability
- High 8.8
CVE-2024-31269unauthenticated · needs a click≤ 1.11.11
WordPress Easy Google Maps plugin <= 1.11.11 - Cross Site Request Forgery (CSRF) vulnerability
- High 8.8
CVE-2023-33926unauthenticated · needs a click≤ 1.11.7
WordPress Easy Google Maps Plugin <= 1.11.7 is vulnerable to Cross Site Request Forgery (CSRF)
- High 7.2
CVE-2026-73367unauthenticated→ 1.14.2
WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability
- High 7.1
CVE-2026-102395unauthenticated · needs a click≤ 1.14.6
WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability
- Medium 6.6
CVE-2025-32138high privilege≤ 1.11.18
WordPress Easy Google Maps plugin <= 1.11.18 - XML External Entity vulnerability
- Medium 5.4
CVE-2023-2526unauthenticated · needs a click≤ 1.11.7
Easy Google Maps <= 1.11.7 - Cross-Site Request Forgery via AJAX action
- Medium 5.4
CVE-2024-5219author+≤ 1.11.15
Easy Google Maps <= 1.11.15 - Authenticated (Author+) Stored Cross-Site Scripting
- Medium 4.8
CVE-2021-39346admin≤ 1.9.33
Google Maps Easy <= 1.9.33 Authenticated Stored Cross-Site Scripting
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).