WP Go Maps – Google Map, OpenStreetMap, Leaflet Map

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

483 searches this plugin appeared in over the last 90 days, 20 listed. 380 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 48% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 2.4 years ago; a band this size takes about a year or more to cross, which places it about 50% of the way through.

1. ★★★★★ excaliburmwj

   4mo ago

   After a recent WP Go Maps Pro update, I ran into a problem with the store locator component – a JS error with the map listing grid, which prevented the listing from showing properly on the first search. I contacted CODECABIN and received excellent support from Matthew Lau. He gave me some custom JS to fix the problem immediately. He was also very pleasant and courteous as well – something I rarely see anymore. Thanks Matthew and CODECABIN! Posted by Mark Johnston

   Read on wp.org ↗
2. ★★★★★ clivegould

   5mo ago

   I ran into a problem with WP Go Maps Pro in an automated migration from a legacy map engine to an Atlas build (Major/Novus) map engine. Some of the settings were lost during the migration and the map no longer functioned properly. I logged a support call with CODECABIN and received a prompt response. The agent (Dylan Auty) was professional, efficient, friendly, very knowledgeable and responsive to email communications. I gave him access to the WP backend and he was able to resolve the problem very quickly so the map worked correctly once again. I have extensive experience of helpdesks and can only say the level of expertise I received today was exemplary. Thanks again Dylan! Posted by Clive Gould

   Read on wp.org ↗
3. ★★★★★ jonoelle

   5mo ago

   I use the plugin for 5 years now and upgraded to the actual version. I got great help for an old website with outdated theme that implied some challenges for the updated plugin to show correctly. I got best support from Dylan and individual code that helped me to stay online with my webpage until my new website is ready to go! Many thanks Dylan for your great work!Best regards, Jochen

   Read on wp.org ↗
4. ★★★★★ pblanchard

   5mo ago

   My name is Pascal Blanchard and i had issues on the gold add-on (clusters and spiderfier). Dylan Auty helped me with a very good time response and was very kind. Thank you for your help!

   Read on wp.org ↗
5. ★★★★★ Symphony Velenciano

   5mo ago

   My name is Symphony Velenciano, and I want to thank Nick who has helped me more than once to get some clarity and great suggestions on how best to use the plugin for my taxi/rideshare company, Vivi. The suggestions worked and I understand the the use of the plugin so much better than previously before. Thank you kindly Nick. I appreciate it very much.

   Read on wp.org ↗
6. ★★★★★ brobken

   5mo ago

   We flagged a potential issue we were facing and we got fast and accurate responses in no time.

   Read on wp.org ↗
7. ★★★★★ jax1964

   5mo ago

   My skills on WP are pretty basic but the documentation for this plugin is spot on!I could follow and managed to implement the maps and manipulate the settings so that it was just right. The support is FIRST RATE! Matthew is so diligent and knowledgeable – he answered all my silly questions with patience and really good explanations. I have now written 3 maps that I am very proud of. Thanks guys.

   Read on wp.org ↗
8. ★★★★★ gregmcpherson

   5mo ago

   I have been using WP Go Maps since 2023 for displaying my walking routes along with my location as I walk to raise awareness to the mental health and toxic drug crisis. People use the map to find where I am during the walks so that they can join me for a couple of km. Over the last few years, I have had a few issues with the plugin, but the support has been quick and has always had any issues resolved before any of my events. Full disclosure…some of the issues were due to my limited knowledge but they still walked me through.Thank you to Jaden Botha for helping me this year and I hope that I’ve now got it all figured out for the coming years!Greg McPherson, FounderOn The Road 4 Mental Health

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-09-28 Version 10.1.10 Fixed issue where the compressed marker ID buffer could be undersized for certain marker sets, causing the server to reject the request and marker searches to return no results. Thanks to Adamcengel Fixed issue where the 10.1.10
2. 2026-09-01 Version 10.1.09 Fixed issue where a crafted unauthenticated request to the compressed REST API parameter parser could trigger an unbounded loop, causing excessive CPU usage and log file growth (denial of service). Security issue, thanks 10.1.09
3. 2026-08-19 Version 10.1.08 Improved point label overlay offset manipulation system to be based on percentages instead of pixel values, this is more consistent across engines Improved Leaflet point label overlay to match Google and OpenLayers, wher 10.1.08
4. 2026-08-13 Version 10.1.07 Added extended data storage support in point labels to support feature expansion Added a new event trigger in MarkerFilter, ‘filteringstart’, which runs before a filter is about to start a run Added option to hoist scrip 10.1.07
5. 2026-07-23 Version 10.1.06 Fixed issue where inactive map data would be served on direct /maps requests even if the map was not active. Security issue, thanks to Bao – BlueRock Fixed issue where individual datasets like /marker, /polygon and /poly 10.1.06
6. 2026-07-23 Version 10.1.05 Fixed issue where inactive map data would still be visible via the /features REST endpoint. Security issue, thanks to Bao – BlueRock Improved JSON encoding in the REST API response layer, using wp_json_encode instead of 10.1.05

All 29 disclosed vulnerabilities are patched in the current version (10.1.10). Sites still on an older version should update.

1. Patched High · 7.5 WP Go Maps – Google Map, OpenStreetMap, Leaflet Map <= 10.1.08 - Unauthenticated Denial of Service ↗
   2026-09-02 CVE-2026-84780 Uncontrolled Resource Consumption Affects <= 10.1.08 Patched in 10.1.09
2. Patched High · 7.5 WP Go Maps – Google Map, OpenStreetMap, Leaflet Map < 10.1.04 - Unauthenticated SQL Injection ↗
   2026-08-04 CVE-2026-15381 Improper Neutralization of Special Elements used in an SQL Command Affects < 10.1.04 Patched in 10.1.04
3. Patched Medium · 5.3 WP Go Maps – Google Map, OpenStreetMap, Leaflet Map <= 10.1.05 - Missing Authorization ↗
   2026-07-22 CVE-2026-25466 Missing Authorization Affects <= 10.1.05 Patched in 10.1.06
4. Patched Medium · 5.3 WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation ↗
   2026-06-19 CVE-2026-12238 Missing Authorization Affects <= 10.1.01 Patched in 10.1.02
5. Patched Medium · 5.3 WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback ↗
   2026-06-05 CVE-2026-8385 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 10.0.09 Patched in 10.0.10
6. Patched Medium · 5.3 Go Maps <= 10.0.9 - Unauthenticated Information Exposure ↗
   2026-05-25 CVE-2026-8386 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 10.0.9 Patched in 10.0.10
7. Patched Medium · 6.4 WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings ↗
   2026-03-17 CVE-2026-4268 Improper Neutralization of Input During Web Page Generation Affects <= 10.0.05 Patched in 10.0.06
8. Patched Medium · 5.3 WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification ↗
   2026-01-24 CVE-2026-0593 Missing Authorization Affects <= 10.0.04 Patched in 10.0.05
9. Patched High · 7.2 Google Maps <= 9.0.47 - Unauthenticated Stored Cross-Site Scripting ↗
   2025-10-21 CVE-2025-11307 Improper Neutralization of Input During Web Page Generation Affects <= 9.0.47 Patched in 9.0.48
10. Patched Medium · 5.3 WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning ↗
    2025-10-17 CVE-2025-11703 Acceptance of Extraneous Untrusted Data With Trusted Data Affects <= 9.0.48 Patched in 9.0.49
11. Patched Medium · 5.4 WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update ↗
    2025-10-08 CVE-2025-11166 Cross-Site Request Forgery Affects <= 9.0.46 Patched in 9.0.47
12. Patched Medium · 4.3 WP Go Maps <= 9.0.40 - Cross-Site Request Forgery ↗
    2025-01-24 CVE-2025-24742 Cross-Site Request Forgery Affects <= 9.0.40 Patched in 9.0.41
13. Patched Medium · 6.4 WP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-06-13 CVE-2024-5994 Improper Neutralization of Input During Web Page Generation Affects <= 9.0.38 Patched in 9.0.39
14. Patched Medium · 6.4 WP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-05-23 CVE-2024-3557 Improper Neutralization of Input During Web Page Generation Affects <= 9.0.36 Patched in 9.0.37
15. Patched Medium · 6.1 WP Google Maps <= 9.0.29 - Reflected Cross-Site Scripting ↗
    2024-03-25 CVE-2024-29931 Improper Neutralization of Input During Web Page Generation Affects <= 9.0.29 Patched in 9.0.30
16. Patched Medium · 5.3 WP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Service ↗
    2024-03-18 CVE-2023-6777 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 9.0.34 Patched in 9.0.35
17. Patched Medium · 4.4 WP Go Maps <= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-03-12 CVE-2023-4839 Improper Neutralization of Input During Web Page Generation Affects <= 9.0.32 Patched in 9.0.33
18. Patched Medium · 6.4 WP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-03-12 CVE-2024-1582 Improper Neutralization of Input During Web Page Generation Affects <= 9.0.32 Patched in 9.0.33
19. Patched Medium · 6.1 WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting ↗
    2024-01-23 CVE-2023-6697 Improper Neutralization of Input During Web Page Generation Affects <= 9.0.28 Patched in 9.0.29
20. Patched Medium · 6.1 WP Google Maps <= 9.0.27 - Unauthenticated Stored Cross-Site Scripting via REST API ↗
    2023-12-18 CVE-2023-6627 Improper Neutralization of Input During Web Page Generation Affects <= 9.0.27 Patched in 9.0.28
21. Patched Medium · 4.9 WP Go Maps <= 9.0.15 - Authenticated (Admin+) Directory Traversal ↗
    2023-01-20 CVE-2022-47595 Improper Limitation of a Pathname to a Restricted Directory Affects <= 9.0.15 Patched in 9.0.16
22. Patched Medium · 5.5 WP Google Maps <= 8.1.12 - Authenticated Stored Cross-Site Scripting ↗
    2021-09-08 CVE-2021-36870 Improper Neutralization of Input During Web Page Generation Affects < 8.1.13 Patched in 8.1.13
23. Patched Medium · 5.4 WP Google Maps <= 8.1.11 - Authenticated Stored Cross-Site Scripting ↗
    2021-06-07 CVE-2021-24383 Improper Neutralization of Input During Web Page Generation Affects < 8.1.12 Patched in 8.1.12
24. Patched Critical · 9.8 WP Go Maps (formerly WP Google Maps) <= 7.11.17 - SQL Injection ↗
    2020-09-09 CVE-2019-10692 Improper Neutralization of Special Elements used in an SQL Command Affects <= 7.11.17 Patched in 7.11.18
25. Patched Medium · 6.1 WP Google Maps <= 7.11.34 - Cross-Site Request Forgery to Cross-Site Scripting ↗
    2019-07-08 CVE-2019-14792 Cross-Site Request Forgery Affects < 7.11.35 Patched in 7.11.35
26. Patched Medium · 4.3 WP Google Maps <= 7.11.27 - Cross-Site Request Forgery ↗
    2019-06-03 Cross-Site Request Forgery Affects < 7.11.28 Patched in 7.11.28
27. Patched Medium · 6.1 WP Google Maps < 7.10.43 - Reflected Cross-Site Scripting ↗
    2019-02-05 CVE-2019-9912 Improper Neutralization of Input During Web Page Generation Affects <= 7.10.41 Patched in 7.10.43
28. Patched Medium · 6.4 WP Google Maps <= 6.3.14 - Stored Cross-Site Scripting ↗
    2016-11-10 Improper Neutralization of Input During Web Page Generation Affects <= 6.3.14 Patched in 6.3.15
29. Patched Medium · 6.1 WP Google Maps <= 6.0.26 - Reflected Cross-Site Scripting ↗
    2014-10-15 CVE-2014-7182 Improper Neutralization of Input During Web Page Generation Affects < 6.0.27 Patched in 6.0.27

Translated into 56 languages, 7 at 90% or more

Plus 32 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-06-07 400K+ → 300K+ down after 3 days in tier
2. 2024-06-04 300K+ → 400K+ up after 1 days in tier
3. 2024-06-03 400K+ → 300K+ down after 2314 days in tier
4. 2018-02-01 300K+ → 400K+ up after 681 days in tier
5. 2016-03-22 200K+ → 300K+ up after 299 days in tier
6. 2015-05-28 100K+ → 200K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for WP Go Maps – Google Map, OpenStreetMap, Leaflet Map into a readme, a review or a deck. It updates itself.

WP Go Maps – Google Map, OpenStreetMap, Leaflet Map: 300K+ active installs, 4.8★ (3,055 reviews). Plugin Pulse (WP Mayor), as of 2026-11-02. https://plugins.wpmayor.com/plugin/wp-google-maps