WP Go Maps – Google Map, OpenStreetMap, Leaflet Map

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 48% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ excaliburmwj

   1mo ago

   After a recent WP Go Maps Pro update, I ran into a problem with the store locator component – a JS error with the map listing grid, which prevented the listing from showing properly on the first search. I contacted CODECABIN and received excellent support from Matthew Lau. He gave me some custom JS to fix the problem immediately. He was also very pleasant and courteous as well – something I rarely see anymore. Thanks Matthew and CODECABIN! Posted by Mark Johnston

   Read on wp.org ↗
2. ★★★★★ clivegould

   2mo ago

   I ran into a problem with WP Go Maps Pro in an automated migration from a legacy map engine to an Atlas build (Major/Novus) map engine. Some of the settings were lost during the migration and the map no longer functioned properly. I logged a support call with CODECABIN and received a prompt response. The agent (Dylan Auty) was professional, efficient, friendly, very knowledgeable and responsive to email communications. I gave him access to the WP backend and he was able to resolve the problem very quickly so the map worked correctly once again. I have extensive experience of helpdesks and can only say the level of expertise I received today was exemplary. Thanks again Dylan! Posted by Clive Gould

   Read on wp.org ↗
3. ★★★★★ jonoelle

   2mo ago

   I use the plugin for 5 years now and upgraded to the actual version. I got great help for an old website with outdated theme that implied some challenges for the updated plugin to show correctly. I got best support from Dylan and individual code that helped me to stay online with my webpage until my new website is ready to go! Many thanks Dylan for your great work!Best regards, Jochen

   Read on wp.org ↗
4. ★★★★★ pblanchard

   2mo ago

   My name is Pascal Blanchard and i had issues on the gold add-on (clusters and spiderfier). Dylan Auty helped me with a very good time response and was very kind. Thank you for your help!

   Read on wp.org ↗
5. ★★★★★ Symphony Velenciano

   3mo ago

   My name is Symphony Velenciano, and I want to thank Nick who has helped me more than once to get some clarity and great suggestions on how best to use the plugin for my taxi/rideshare company, Vivi. The suggestions worked and I understand the the use of the plugin so much better than previously before. Thank you kindly Nick. I appreciate it very much.

   Read on wp.org ↗
6. ★★★★★ brobken

   3mo ago

   We flagged a potential issue we were facing and we got fast and accurate responses in no time.

   Read on wp.org ↗
7. ★★★★★ jax1964

   3mo ago

   My skills on WP are pretty basic but the documentation for this plugin is spot on!I could follow and managed to implement the maps and manipulate the settings so that it was just right. The support is FIRST RATE! Matthew is so diligent and knowledgeable – he answered all my silly questions with patience and really good explanations. I have now written 3 maps that I am very proud of. Thanks guys.

   Read on wp.org ↗
8. ★★★★★ gregmcpherson

   3mo ago

   I have been using WP Go Maps since 2023 for displaying my walking routes along with my location as I walk to raise awareness to the mental health and toxic drug crisis. People use the map to find where I am during the walks so that they can join me for a couple of km. Over the last few years, I have had a few issues with the plugin, but the support has been quick and has always had any issues resolved before any of my events. Full disclosure…some of the issues were due to my limited knowledge but they still walked me through.Thank you to Jaden Botha for helping me this year and I hope that I’ve now got it all figured out for the coming years!Greg McPherson, FounderOn The Road 4 Mental Health

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-08-19 Version 10.1.08 Improved point label overlay offset manipulation system to be based on percentages instead of pixel values, this is more consistent across engines Improved Leaflet point label overlay to match Google and OpenLayers, wher 10.1.08
2. 2026-08-13 Version 10.1.07 Added extended data storage support in point labels to support feature expansion Added a new event trigger in MarkerFilter, ‘filteringstart’, which runs before a filter is about to start a run Added option to hoist scrip 10.1.07
3. 2026-07-23 Version 10.1.06 Fixed issue where inactive map data would be served on direct /maps requests even if the map was not active. Security issue, thanks to Bao – BlueRock Fixed issue where individual datasets like /marker, /polygon and /poly 10.1.06
4. 2026-07-23 Version 10.1.05 Fixed issue where inactive map data would still be visible via the /features REST endpoint. Security issue, thanks to Bao – BlueRock Improved JSON encoding in the REST API response layer, using wp_json_encode instead of 10.1.05
5. 2026-07-10 Version 10.1.04 Fixed issue where unauthenticated SQL Injection was possible via the limit paramater in the Marker Filter. Security issue, thanks to Jakub Herman 10.1.04
6. 2026-06-17 Version 10.1.03 Fixed issue where the internal engine assignment could be skipped on fresh installs, defaulting new installations to Atlas Major instead of the intended random assignment 10.1.03

28 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 7.5 WP Go Maps – Google Map, OpenStreetMap, Leaflet Map < 10.1.04 - Unauthenticated SQL Injection ↗
   2026-08-04 CVE-2026-15381 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 10.1.04 Patched in 10.1.04
2. Medium · 5.3 WP Go Maps – Google Map, OpenStreetMap, Leaflet Map <= 10.1.05 - Missing Authorization ↗
   2026-07-22 CVE-2026-25466 Missing Authorization Affects <= 10.1.05 Patched in 10.1.06
3. Medium · 5.3 WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation ↗
   2026-06-19 CVE-2026-12238 Missing Authorization Affects <= 10.1.01 Patched in 10.1.02
4. Medium · 5.3 WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback ↗
   2026-06-05 CVE-2026-8385 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 10.0.09 Patched in 10.0.10
5. Medium · 5.3 Go Maps <= 10.0.9 - Unauthenticated Information Exposure ↗
   2026-05-25 CVE-2026-8386 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 10.0.9 Patched in 10.0.10
6. Medium · 6.4 WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings ↗
   2026-03-17 CVE-2026-4268 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 10.0.05 Patched in 10.0.06
7. Medium · 5.3 WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification ↗
   2026-01-24 CVE-2026-0593 Missing Authorization Affects <= 10.0.04 Patched in 10.0.05
8. High · 7.2 Google Maps <= 9.0.47 - Unauthenticated Stored Cross-Site Scripting ↗
   2025-10-21 CVE-2025-11307 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.0.47 Patched in 9.0.48
9. Medium · 5.3 WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning ↗
   2025-10-17 CVE-2025-11703 Acceptance of Extraneous Untrusted Data With Trusted Data Affects <= 9.0.48 Patched in 9.0.49
10. Medium · 5.4 WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update ↗
    2025-10-08 CVE-2025-11166 Cross-Site Request Forgery (CSRF) Affects <= 9.0.46 Patched in 9.0.47
11. Medium · 4.3 WP Go Maps <= 9.0.40 - Cross-Site Request Forgery ↗
    2025-01-24 CVE-2025-24742 Cross-Site Request Forgery (CSRF) Affects <= 9.0.40 Patched in 9.0.41
12. Medium · 6.4 WP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-06-13 CVE-2024-5994 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.0.38 Patched in 9.0.39
13. Medium · 6.4 WP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-05-23 CVE-2024-3557 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.0.36 Patched in 9.0.37
14. Medium · 6.1 WP Google Maps <= 9.0.29 - Reflected Cross-Site Scripting ↗
    2024-03-25 CVE-2024-29931 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.0.29 Patched in 9.0.30
15. Medium · 5.3 WP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Service ↗
    2024-03-18 CVE-2023-6777 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 9.0.34 Patched in 9.0.35
16. Medium · 4.4 WP Go Maps <= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-03-12 CVE-2023-4839 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.0.32 Patched in 9.0.33
17. Medium · 6.4 WP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-03-12 CVE-2024-1582 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.0.32 Patched in 9.0.33
18. Medium · 6.1 WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting ↗
    2024-01-23 CVE-2023-6697 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.0.28 Patched in 9.0.29
19. Medium · 6.1 WP Google Maps <= 9.0.27 - Unauthenticated Stored Cross-Site Scripting via REST API ↗
    2023-12-18 CVE-2023-6627 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.0.27 Patched in 9.0.28
20. Medium · 4.9 WP Go Maps <= 9.0.15 - Authenticated (Admin+) Directory Traversal ↗
    2023-01-20 CVE-2022-47595 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 9.0.15 Patched in 9.0.16
21. Medium · 5.5 WP Google Maps <= 8.1.12 - Authenticated Stored Cross-Site Scripting ↗
    2021-09-08 CVE-2021-36870 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 8.1.13 Patched in 8.1.13
22. Medium · 5.4 WP Google Maps <= 8.1.11 - Authenticated Stored Cross-Site Scripting ↗
    2021-06-07 CVE-2021-24383 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 8.1.12 Patched in 8.1.12
23. Critical · 9.8 WP Go Maps (formerly WP Google Maps) <= 7.11.17 - SQL Injection ↗
    2020-09-09 CVE-2019-10692 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 7.11.17 Patched in 7.11.18
24. Medium · 6.1 WP Google Maps <= 7.11.34 - Cross-Site Request Forgery to Cross-Site Scripting ↗
    2019-07-08 CVE-2019-14792 Cross-Site Request Forgery (CSRF) Affects < 7.11.35 Patched in 7.11.35
25. Medium · 4.3 WP Google Maps <= 7.11.27 - Cross-Site Request Forgery ↗
    2019-06-03 Cross-Site Request Forgery (CSRF) Affects < 7.11.28 Patched in 7.11.28
26. Medium · 6.1 WP Google Maps < 7.10.43 - Reflected Cross-Site Scripting ↗
    2019-02-05 CVE-2019-9912 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.10.41 Patched in 7.10.43
27. Medium · 6.4 WP Google Maps <= 6.3.14 - Stored Cross-Site Scripting ↗
    2016-11-10 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.3.14 Patched in 6.3.15
28. Medium · 6.1 WP Google Maps <= 6.0.26 - Reflected Cross-Site Scripting ↗
    2014-10-15 CVE-2014-7182 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 6.0.27 Patched in 6.0.27

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 55 languages, 3 at 90% or more

Plus 31 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-06-07 400K+ → 300K+ down after 3 days in tier
2. 2024-06-04 300K+ → 400K+ up after 1 days in tier
3. 2024-06-03 400K+ → 300K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Maps Plugin using Google Maps for WordPress – WP Google Map 10K+ installs · 4.8★ · 4 shared tags A
• BS Maps – Google Map and Leaflet Map for Elementor and WPBackery 70+ installs · 4.0★ · 4 shared tags D
• CM Map Locations – Visualize and share your locations in a few clicks 70+ installs · 3.5★ · 4 shared tags B
• WP Store Locator 50K+ installs · 4.8★ · 3 shared tags A
• Flexible Map 7K+ installs · 4.7★ · 3 shared tags A
• WP Go Maps Block 3K+ installs · 4.6★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for WP Go Maps – Google Map, OpenStreetMap, Leaflet Map into a readme, a review or a deck. It updates itself.

WP Go Maps – Google Map, OpenStreetMap, Leaflet Map: 300K+ active installs, 4.8★ (3,032 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/wp-google-maps