| CVE-2025-13364 | WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode | flippercode | WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters | Medium | 6.4 | 2026-04-16 06:44:52 | Deep Dive |
| CVE-2026-4429 | OSM <= 6.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attribute | photoweblog | OSM – OpenStreetMap | Medium | 6.4 | 2026-04-09 02:25:06 | Deep Dive |
| CVE-2026-33559 | WordPress plugin OpenStreetMap 跨站脚本漏洞 | MiKa | OpenStreetMap | 中危 | - | 2026-03-27 04:56:41 | Deep Dive |
| CVE-2026-2580 | WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter | flippercode | WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters | High | 7.5 | 2026-03-22 23:24:32 | Deep Dive |
| CVE-2026-3222 | WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter | flippercode | WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters | High | 7.5 | 2026-03-11 05:27:17 | Deep Dive |
| CVE-2025-12062 | WP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion | flippercode | WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters | High | 8.8 | 2026-02-16 23:22:38 | Deep Dive |
| CVE-2025-9123 | CBX Map for Google Map & OpenStreetMap <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | manchumahara | CBX Map for Google Map & OpenStreetMap | Medium | 6.4 | 2025-09-11 07:25:02 | Deep Dive |
| CVE-2025-6572 | OpenStreetMap for Gutenberg and WPBakery Page Builder <= 1.2.0 - Contributor+ Stored XSS | Unknown | OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) | 中危 | - | 2025-08-08 06:00:04 | Deep Dive |
| CVE-2025-47669 | WordPress CBX Map for Google Map & OpenStreetMap plugin <= 1.1.12 - Cross Site Scripting (XSS) Vulnerability | Sabuj Kundu | CBX Map for Google Map & OpenStreetMap | Medium | 6.5 | 2025-05-07 14:20:51 | Deep Dive |
| CVE-2024-11827 | Out of the Block: OpenStreetMap <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ootb_query Shortcode | gsarig | Out of the Block: OpenStreetMap | Medium | 6.4 | 2024-12-13 11:23:43 | Deep Dive |
| CVE-2024-8991 | OSM <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 Shortcodes | photoweblog | OSM – OpenStreetMap | Medium | 6.4 | 2024-09-27 06:53:59 | Deep Dive |
| CVE-2024-3604 | OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) SQL Injection | photoweblog | OSM – OpenStreetMap | Critical | 9.9 | 2024-07-09 08:33:12 | Deep Dive |
| CVE-2024-3603 | OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | photoweblog | OSM – OpenStreetMap | Medium | 6.4 | 2024-07-09 08:33:07 | Deep Dive |
| CVE-2024-3670 | Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) <= 3.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | harmr | Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) | Medium | 6.4 | 2024-05-02 16:52:10 | Deep Dive |
| CVE-2024-30450 | WordPress OpenStreetMap for Gutenberg and WPBakery Page Builder plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability | Step-Byte-Service GmbH | OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) | Medium | 6.5 | 2024-03-29 16:45:21 | Deep Dive |
| CVE-2024-22297 | WordPress CBX Map for Google Map & OpenStreetMap Plugin <= 1.1.11 is vulnerable to Cross Site Scripting (XSS) | Codeboxr | CBX Map for Google Map & OpenStreetMap | Medium | 6.5 | 2024-01-31 17:27:54 | Deep Dive |
| CVE-2023-47240 | WordPress CBX Map for Google Map & OpenStreetMap Plugin <= 1.1.11 is vulnerable to Cross Site Scripting (XSS) | Codeboxr | CBX Map for Google Map & OpenStreetMap | Medium | 6.5 | 2023-11-16 18:48:08 | Deep Dive |
| CVE-2022-4677 | Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 3.12.7 - Contributor+ Stored XSS via Shortcode | Unknown | Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) | 中危 | - | 2023-02-06 19:59:40 | Deep Dive |
| CVE-2022-30544 | WordPress OSM – OpenStreetMap Plugin <= 6.0.1 is vulnerable to Cross Site Request Forgery (CSRF) | MiKa | OSM – OpenStreetMap | Medium | 4.3 | 2023-01-17 04:23:59 | Deep Dive |
| CVE-2022-1123 | Leaflet Maps Marker < 3.12.5 - Admin+ SQLi | Unknown | Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) | 高危 | - | 2022-08-29 14:40:24 | Deep Dive |