WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

620 searches this plugin appeared in over the last 90 days, 20 listed. 523 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 9 months ago; the previous band took 14 months to cross, which places it about 50% of the way through.

1. ★★★★★ ARSGeek

   7mo ago

   I bought WP Maps Pro expecting it to be fully responsive, but it relies on fixed height settings for desktop, tablet, and mobile rather than adapting naturally to the viewport or container. That may be acceptable for simple use cases, but it breaks down in modern responsive layouts, especially when the map is placed beside another element in a column and needs to match height dynamically. For a premium plugin, this feels outdated. If you only need fixed device-based heights, it may work for you. But if you expect truly responsive behavior, this plugin is disappointing.

   Read on wp.org ↗
2. ★★★★★ goldenhelpdesk

   1.2y ago

   Awesome plug in with so many options. Support is top tier. Quick and reliable. Thanks!

   Read on wp.org ↗
3. ★★★★★ lgesistemi

   1.3y ago

   The plugin is very good, beautiful and easy to use. Support Team very professional, helpful and fast

   Read on wp.org ↗
4. ★★★★★ releifrei

   1.3y ago

   Thank you for your quick help!Now, everything works!

   Read on wp.org ↗
5. ★★★★★ SaraRow

   1.4y ago

   The plugin works like a charm, very easy to manage, and a really good attention by their support team. They only feature I miss is to be able to filter the locations in the admin area, to be managed more easily.

   Read on wp.org ↗
6. ★★★★★ starling57

   1.5y ago

   WP Maps is a plugin I’ve been using for several years across several sites, all good. Had a small issue on a dev site recently, with the zoom function not behaving – following some initial Q&A with the support consultant, I provided admin access and they sorted it pronto. Thanks you so much!

   Read on wp.org ↗
7. ★★★★★ yesdog

   1.9y ago

   Super helpful and professional service. Quick to respond – thank you very much

   Read on wp.org ↗
8. ★★★★★ cragbriggs

   1.9y ago

   I look after a client’s website which I inherited along with the installed WP Maps plugin so I was unfamiliar with it. After many months and regular updates something knocked out the map and it stopped working. I tried everything I coudl think of but could not get teh map back again. So I contacted support. They jumped on the issue right away. They logged into the site and made the necessary change to make the map work again. They switched my page from using a Widget to display the map to a Raw Code block using the map shortcode. (About the only thing I didn’t try). It is always refreshing to experience support to this high standard when you need it. I was very impressed. Thank you for your help. And this was on the plugin’s free version.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 4.9.6 Fix : load Google Maps API v3.64 to prevent DrawingManager deprecation issues, 4.9.6
2. — Version 4.9.5 Fix : Fixed an authenticated stored XSS vulnerability in the location_messages parameter by improving input sanitization and output escaping. Fix : Resolved Select2 dropdown style conflicts with other plugins by applying 4.9.5
3. — Version 4.9.4 Fix : Resolved a conflict with Font Awesome 4 icons not rendering correctly when the map is loaded. Fix : Frontend UI issue fixed. 4.9.4
4. — Version 4.9.3 Added : Drawing feature (allows users to draw shapes such as polygons, polylines, rectangles, and circles on the map). Fix : Fixed file upload security issues for custom templates by improving sanitization and adding per 4.9.3
5. — Version 4.9.2 Fix : Dispatch an event within apply_filters to retrieve map_obj. Fix : Fix the security issue in the shortcode parameter. Fix : Fix the sql injection security issue. Fix : Small UI changes for frontend map and listing. 4.9.2
6. — Version 4.9.1 Fix : Implemented escaped and safer google maps HTML output. 4.9.1

All 31 disclosed vulnerabilities are patched in the current version (5.0.3). Sites still on an older version should update.

1. Patched Medium · 6.4 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter ↗
   2026-09-24 CVE-2026-13179 Improper Neutralization of Input During Web Page Generation Affects <= 4.9.8 Patched in 5.0.0
2. Patched High · 7.5 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter ↗
   2026-09-24 CVE-2026-13456 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 4.9.8 Patched in 5.0.0
3. Patched Medium · 4.9 WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.9 - Authenticated (Administrator+) SQL Injection ↗
   2026-09-17 CVE-2026-66618 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.9.9 Patched in 5.0.0
4. Patched Medium · 4.3 WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.8 - Missing Authorization ↗
   2026-08-21 CVE-2026-18466 Missing Authorization Affects < 4.9.8 Patched in 4.9.8
5. Patched Medium · 6.5 Maps <= 4.9.6 - Authenticated (Subscriber+) Denial of Service ↗
   2026-08-03 CVE-2026-16265 Uncontrolled Resource Consumption Affects <= 4.9.6 Patched in 4.9.7
6. Patched Medium · 4.3 WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.6 - Authenticated (Subscriber+) Information Exposure ↗
   2026-07-31 CVE-2026-28144 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.9.6 Patched in 4.9.7
7. Patched High · 7.5 WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 - Authenticated (Subscriber+) Local File Inclusion ↗
   2026-06-11 CVE-2026-6381 Improper Control of Filename for Include/Require Statement in PHP Program Affects < 4.9.3 Patched in 4.9.3
8. Patched Medium · 4.4 WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter ↗
   2026-06-05 CVE-2026-9594 Improper Neutralization of Input During Web Page Generation Affects <= 4.9.4 Patched in 4.9.5
9. Patched Medium · 6.4 WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode ↗
   2026-04-15 CVE-2025-13364 Improper Neutralization of Input During Web Page Generation Affects <= 4.8.7 Patched in 4.8.8
10. Patched High · 7.5 WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection ↗
    2026-04-08 CVE-2026-39492 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.9.1 Patched in 4.9.2
11. Patched High · 7.5 WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter ↗
    2026-03-22 CVE-2026-2580 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.9.1 Patched in 4.9.2
12. Patched High · 7.5 WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter ↗
    2026-03-10 CVE-2026-3222 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.9.1 Patched in 4.9.2
13. Patched High · 8.8 WP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion ↗
    2026-02-16 CVE-2025-12062 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.8.6 Patched in 4.8.7
14. Patched Medium · 6.6 Maps <= 4.8.6 - Authenticated (Administrator+) PHP Object Injection ↗
    2025-11-02 CVE-2025-67535 Deserialization of Untrusted Data Affects <= 4.8.6 Patched in 4.8.7
15. Patched Medium · 4.4 WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-04-10 CVE-2025-3504 Improper Neutralization of Input During Web Page Generation Affects <= 4.7.1 Patched in 4.7.2
16. Patched Medium · 4.4 WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-04-10 CVE-2025-3502 Improper Neutralization of Input During Web Page Generation Affects <= 4.7.1 Patched in 4.7.2
17. Patched Medium · 4.4 WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-04-10 CVE-2025-3503 Improper Neutralization of Input During Web Page Generation Affects <= 4.7.1 Patched in 4.7.2
18. Patched High · 8.8 WordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injection ↗
    2024-06-28 CVE-2024-2386 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.6.1 Patched in 4.6.2
19. Patched Medium · 5.4 WP Google Map Plugin <= 4.4.2 - Cross-Site Request Forgery via delete() ↗
    2023-03-13 CVE-2023-28172 Cross-Site Request Forgery Affects <= 4.4.2 Patched in 4.4.3
20. Patched Medium · 5.5 WP MAPS <= 4.3.9 - Authenticated (Editor+) Stored Cross-Site Scripting ↗
    2023-01-20 CVE-2023-23878 Improper Neutralization of Input During Web Page Generation Affects <= 4.3.9 Patched in 4.4.0
21. Patched Medium · 5.4 WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.2.3 - Cross-Site Request Forgery ↗
    2022-02-22 CVE-2022-25600 Cross-Site Request Forgery Affects < 4.2.4 Patched in 4.2.4
22. Patched High · 7.2 WP Google Map Plugin <= 4.1.4 - Authenticated SQL Injection via Orderby ↗
    2020-11-25 CVE-2021-24130 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.1.4 Patched in 4.1.5
23. Patched Medium · 6.1 WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.0.9 - Reflected Cross-Site Scripting ↗
    2019-09-21 Improper Neutralization of Input During Web Page Generation Affects <= 4.0.9 Patched in 4.1.0
24. Patched High · 8.8 WP Google Map Plugin <= 4.0.9 - Cross-Site Request Forgery to PHP Object Injection ↗
    2019-09-21 Deserialization of Untrusted Data Affects < 4.1.0 Patched in 4.1.0
25. Patched Medium · 5.4 WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps < 4.0.4 - Cross-Site Scripting ↗
    2018-04-27 CVE-2018-0577 Improper Neutralization of Input During Web Page Generation Affects < 4.0.4 Patched in 4.0.4
26. Patched Medium · 6.1 WP Google Map Plugin <= 3.1.1 - Cross-Site Scripting ↗
    2016-07-27 CVE-2016-10878 Improper Neutralization of Input During Web Page Generation Affects < 3.1.2 Patched in 3.1.2
27. Patched High · 8.8 WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery ↗
    2015-08-21 CVE-2015-9309 Cross-Site Request Forgery Affects < 2.3.10 Patched in 2.3.10
28. Patched High · 8.8 WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery ↗
    2015-08-21 CVE-2015-9307 Cross-Site Request Forgery Affects < 2.3.10 Patched in 2.3.10
29. Patched High · 8.8 WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery ↗
    2015-08-21 CVE-2015-9308 Cross-Site Request Forgery Affects < 2.3.10 Patched in 2.3.10
30. Patched High · 7.1 WP Google Map Plugin < 3.0.0 - Cross-Site Request Forgery to Cross-Site Scripting ↗
    2015-08-20 Cross-Site Request Forgery Affects < 3.0.0 Patched in 3.0.0
31. Patched Medium · 6.1 WP Google Map Plugin < 2.3.7 - Reflected Cross-Site Scripting ↗
    2015-04-24 CVE-2015-9305 Improper Neutralization of Input During Web Page Generation Affects < 2.3.7 Patched in 2.3.7

Translated into 16 languages, 0 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

This plugin’s searches fall outside the topics measured so far. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-02-21 70K+ → 60K+ down after 411 days in tier
2. 2025-01-06 80K+ → 70K+ down after 345 days in tier
3. 2024-01-27 90K+ → 80K+ down after 299 days in tier
4. 2023-04-03 100K+ → 90K+ down after 1858 days in tier
5. 2018-03-02 90K+ → 100K+ up after 29 days in tier
6. 2018-02-01 80K+ → 90K+ up after 231 days in tier
7. 2017-06-15 70K+ → 80K+ up after 356 days in tier
8. 2016-06-24 50K+ → 70K+ up after 236 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings into a readme, a review or a deck. It updates itself.

WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings: 60K+ active installs, 4.3★ (122 reviews). Plugin Pulse (WP Mayor), as of 2026-11-04. https://plugins.wpmayor.com/plugin/wp-google-map-plugin