WP Go Maps – Google Map, OpenStreetMap, Leaflet Map

86 Quality Score

Active Installs

25/30

With 300,000 active installs and a high score of 82/30, this is one of the most widely used mapping plugins in the WordPress ecosystem.

Update Freshness

25/25

A perfect 100/25 maintenance score reflects the recent 2026-07-10 update and confirms an actively maintained codebase that keeps pace with WordPress releases.

User Rating

14/15

A 96 out of 100 user rating across over 3,000 reviews indicates strong and consistent user satisfaction.

Support Health

8/15

The support score of 50/15 is the weakest signal, though it stems from just 4 threads all resolved, a small sample size for a plugin this popular.

WP Compatibility

15/15

A full 100/15 compatibility score is backed by official testing against WordPress 7.0.1 and PHP 7.0 minimum requirements.

Scores higher than 97% of indexed plugins

About

The easiest to use WordPress map plugin! Create a custom map, map block, store locator or map widget with high quality markers.

Active Installs 300k+

Rating ★★★★½ 4.8/5

Last Updated 2026-09-01 6:12am GMT

Requires WordPress 6.0+

Tested Up To 7.1

Requires PHP 7.0+

Security History

29 known vulnerabilities, all patched

1 Critical 3 High 25 Medium

Most recent: September 2, 2026

View details ▸

WP Go Maps – Google Map, OpenStreetMap, Leaflet Map <= 10.1.08 - Unauthenticated Denial of Service High

September 2, 2026 Patched in ["10.1.09"] CVE-2026-84780

WP Go Maps – Google Map, OpenStreetMap, Leaflet Map < 10.1.04 - Unauthenticated SQL Injection High

August 4, 2026 Patched in ["10.1.04"] CVE-2026-15381

WP Go Maps – Google Map, OpenStreetMap, Leaflet Map <= 10.1.05 - Missing Authorization Medium

July 22, 2026 Patched in ["10.1.06"] CVE-2026-25466

WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation Medium

June 19, 2026 Patched in ["10.1.02"] CVE-2026-12238

WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback Medium

June 5, 2026 Patched in ["10.0.10"] CVE-2026-8385

Go Maps <= 10.0.9 - Unauthenticated Information Exposure Medium

May 25, 2026 Patched in ["10.0.10"] CVE-2026-8386

WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings Medium

March 17, 2026 Patched in ["10.0.06"] CVE-2026-4268

WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification Medium

January 24, 2026 Patched in ["10.0.05"] CVE-2026-0593

Google Maps <= 9.0.47 - Unauthenticated Stored Cross-Site Scripting High

October 21, 2025 Patched in ["9.0.48"] CVE-2025-11307

WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning Medium

October 17, 2025 Patched in ["9.0.49"] CVE-2025-11703

WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update Medium

October 8, 2025 Patched in ["9.0.47"] CVE-2025-11166

WP Go Maps <= 9.0.40 - Cross-Site Request Forgery Medium

January 24, 2025 Patched in ["9.0.41"] CVE-2025-24742

WP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

June 13, 2024 Patched in ["9.0.39"] CVE-2024-5994

WP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

May 23, 2024 Patched in ["9.0.37"] CVE-2024-3557

WP Google Maps <= 9.0.29 - Reflected Cross-Site Scripting Medium

March 25, 2024 Patched in ["9.0.30"] CVE-2024-29931

WP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Service Medium

March 18, 2024 Patched in ["9.0.35"] CVE-2023-6777

WP Go Maps <= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

March 12, 2024 Patched in ["9.0.33"] CVE-2023-4839

WP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

March 12, 2024 Patched in ["9.0.33"] CVE-2024-1582

WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting Medium

January 23, 2024 Patched in ["9.0.29"] CVE-2023-6697

WP Google Maps <= 9.0.27 - Unauthenticated Stored Cross-Site Scripting via REST API Medium

December 18, 2023 Patched in ["9.0.28"] CVE-2023-6627

WP Go Maps <= 9.0.15 - Authenticated (Admin+) Directory Traversal Medium

January 20, 2023 Patched in ["9.0.16"] CVE-2022-47595

WP Google Maps <= 8.1.12 - Authenticated Stored Cross-Site Scripting Medium

September 8, 2021 Patched in ["8.1.13"] CVE-2021-36870

WP Google Maps <= 8.1.11 - Authenticated Stored Cross-Site Scripting Medium

June 7, 2021 Patched in ["8.1.12"] CVE-2021-24383

WP Go Maps (formerly WP Google Maps) <= 7.11.17 - SQL Injection Critical

September 9, 2020 Patched in ["7.11.18"] CVE-2019-10692

WP Google Maps <= 7.11.34 - Cross-Site Request Forgery to Cross-Site Scripting Medium

July 8, 2019 Patched in ["7.11.35"] CVE-2019-14792

WP Google Maps <= 7.11.27 - Cross-Site Request Forgery Medium

June 3, 2019 Patched in ["7.11.28"]

WP Google Maps < 7.10.43 - Reflected Cross-Site Scripting Medium

February 5, 2019 Patched in ["7.10.43"] CVE-2019-9912

WP Google Maps <= 6.3.14 - Stored Cross-Site Scripting Medium

November 10, 2016 Patched in ["6.3.15"]

WP Google Maps <= 6.0.26 - Reflected Cross-Site Scripting Medium

October 15, 2014 Patched in ["6.0.27"] CVE-2014-7182

What It Does

WP Go Maps lets you embed interactive maps on WordPress pages and posts using Google Maps, OpenStreetMap, or Leaflet, with support for custom markers, store locators, and dedicated map blocks and widgets.

Who It's For

This plugin is best for small to mid-sized business owners, real estate agents, and local directory sites that need a quick way to display locations, contact maps, or basic store locators without writing custom code.

Who Should Skip It

Sites that only need a single static location pin or a simple embedded map should skip this and use a lighter iframe or block-based alternative.

The Bottom Line

WP Go Maps earns an 86.43 overall quality score, pairing top-tier maintenance and compatibility with massive market share. The thin support footprint is a mild caveat, but the 96/100 rating from 3,000+ users makes it a safe pick for most WordPress sites needing interactive maps.

Related Plugins

WP Store Locator 83/100

Pick this if your primary need is a dedicated store finder with geolocation rather than general-purpose map embedding.

API KEY for Google Maps 83/100

Choose this lightweight plugin if you only need to fix the Google Maps API key on an existing map setup, not add new mapping features.

iframe 82/100

Reach for iframe if you simply want to drop in a Google Maps embed on a page without any custom markers or interactive features.

Leaflet Map 82/100

Choose Leaflet Map when you want a lighter, OpenStreetMap-first approach without the overhead of Google Maps API configuration.

WP Maps 82/100

Consider this when you need advanced listing, directory, and filtering features layered on top of the map.