CVE-2026-9594: WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'locationmessages' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to hold the custom wpgmpmanagelocation capability, which is granted to administrators by default but can be assigned to lower-privileged roles via the plugin's Permissions screen.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters (WordPress plugin)to a version that resolves this vulnerability.Fixed in 4.9.4 - Configuration
On the plugin’s Permissions screen, remove the wpgmp_manage_location capability from any roles below administrators.
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters (WordPress plugin) Permissions screen: wpgmp_manage_location capability assignment = Ensure the custom wpgmp_manage_location capability is NOT granted to lower-privileged roles (limit to administrators only)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9594?
CVE-2026-9594 has a medium severity rating of 4.4.
How do I fix CVE-2026-9594?
To fix CVE-2026-9594, update the WP Maps plugin to version 4.9.5 or later.
What type of vulnerability is CVE-2026-9594?
CVE-2026-9594 is a Stored Cross-Site Scripting (XSS) vulnerability.
What parameters are affected by CVE-2026-9594?
CVE-2026-9594 is specifically vulnerable through the 'location_messages' parameter.
Who is affected by CVE-2026-9594?
CVE-2026-9594 affects users of the WP Maps plugin for WordPress who are running versions 4.9.4 or earlier.