Read the docs
TI-2021-06422 Aliases CVE-2021-24130GHSA-3xhc-3pqp-v39v

WP Google Map Plugin < 4.1.5 - Authenticated SQL Injection

Priority LOW 35CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user (admin+).

Why it matters now

EPSS 0.01416 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WP Google Map Plugin (Unknown): 4.1.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWP Google Map Plugin4.1.5 to before 4.1.54.1.5Patch availableCNA
  • WP Google Map Plugin VendorUnknown Affected 4.1.5 to before 4.1.5 Fixed in 4.1.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:weplugins:wp_maps:*:*:*:*:*:wordpress:*:*before 4.1.5VulnerableWeplugins
  • cpe:2.3:a:weplugins:wp_maps:*:*:*:*:*:wordpress:*:* Versions before 4.1.5 Vulnerable ·Weplugins

Remediation

  • Fix · CNA WP Google Map Plugin (Unknown) Fixed in 4.1.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24130
  2. 2026-10-03 Alias added: GHSA-3xhc-3pqp-v39v

References

Exploit 1

  • TI-2025-03078 WP Maps < 4.7.2 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
  • TI-2025-03077 WP Maps < 4.7.2 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
  • TI-2025-03076 WP Maps < 4.7.2 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
  • TI-2023-12741 WordPress WP Google Map Plugin Plugin <= 4.4.2 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2022-09190 WordPress WP Google Map plugin <= 4.2.3 - Cross-Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
  • TI-2015-07686 The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature. CVSS 3.1HIGH 8.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences