Skip to content
PluginCanary

WP Go Maps

WP Go Maps - Google Map, OpenStreetMap, Leaflet Map
by WPGMaps · 300,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 28 Sep 2026, 29 releases in 24 months, no unpatched vulnerabilities.

84/ 100 Canary Score

Based on 4 of 5 areas

Sub-scores for WP Go Maps
Ownership100
Maintenance100
Security60
SupportNo data
Reputation75

How the score works

Quick answers

Is WP Go Maps still maintained?
Yes. Last release 28 Sep 2026, 29 releases in the last 24 months. 28 Sep 2026 · wordpress.org
Who owns WP Go Maps, and has it changed hands?
Changed. New committer NickDuncan made a first commit on 1 Jun 2026. 1 Jun 2026 · SVN log
Was WP Go Maps removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is WP Go Maps safe?
29 known vulnerabilities, all fixed (latest in 10.1.09). Not on the exploited list. 2 Sep 2026 · Wordfence Intelligence
Is the latest WP Go Maps update safe to install?
No ownership change before 10.1.10. No one-star spike after it. 28 Sep 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • InfoMOM-2Downloads in the last 4 complete weeks are down by half or more vs the median week of the 26 weeks before. Review this plugin.3 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
WPGMaps26 Jan 2012 to 20 Sep 2021, 230 commits
perryrylance11 Apr 2018 to 12 Jun 2020, 145 commits
DylanAuty8 Jul 2019 to 28 Sep 2026, 100 commits
NickDuncan1 Jun 2026 to 18 Jun 2026, 11 commits

New committer NickDuncan made a first commit on 1 Jun 2026.

Maintenance

Last release
37 days ago
Releases, 24 months
29
Tested up to
7.1 current
Requires PHP
7.0 supported 8.2+
Releases per quarter
Releases per quarter for WP Go Maps
Q1 20247
Q2 20245
Q3 20240
Q4 20244
Q1 20251
Q2 20251
Q3 20250
Q4 20258
Q1 20262
Q2 20269
Q3 20267
Q4 20260

Last release 28 Sep 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (26 reviews). Lifetime: 4.8.

Average rating stayed at 5.0 between Q3 2026 and Q4 2026.

Rating distribution
5 star2821
4 star63
3 star16
2 star31
1 star124

Security record

12 vulnerabilities in 24 months (29 on record), all patched (latest fixed in 10.1.09).

Show 29 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
2 Sep 2026WP Go Maps - Google Map, OpenStreetMap, Leaflet Map <= 10.1.08 - Unauthenticated Denial of Service7.5<= 10.1.0810.1.09Patched before disclosure
4 Aug 2026WP Go Maps - Google Map, OpenStreetMap, Leaflet Map < 10.1.04 - Unauthenticated SQL Injection7.5< 10.1.0410.1.04Patched before disclosure
22 Jul 2026WP Go Maps - Google Map, OpenStreetMap, Leaflet Map <= 10.1.05 - Missing Authorization5.3<= 10.1.0510.1.062
19 Jun 2026WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation5.3<= 10.1.0110.1.02Patched before disclosure
5 Jun 2026WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback5.3<= 10.0.0910.0.10Patched before disclosure
25 May 2026Go Maps <= 10.0.9 - Unauthenticated Information Exposure5.3<= 10.0.910.0.10Patched before disclosure
17 Mar 2026WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings6.4<= 10.0.0510.0.0629
24 Jan 2026WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification5.3<= 10.0.0410.0.0552
21 Oct 2025Google Maps <= 9.0.47 - Unauthenticated Stored Cross-Site Scripting7.2<= 9.0.479.0.48Patched before disclosure
17 Oct 2025WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning5.3<= 9.0.489.0.4924
8 Oct 2025WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update5.4<= 9.0.469.0.47Patched before disclosure
24 Jan 2025WP Go Maps <= 9.0.40 - Cross-Site Request Forgery4.3<= 9.0.409.0.41Patched before disclosure
13 Jun 2024WP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 9.0.389.0.394
23 May 2024WP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 9.0.369.0.37Patched before disclosure
25 Mar 2024WP Google Maps <= 9.0.29 - Reflected Cross-Site Scripting6.1<= 9.0.299.0.30Patched before disclosure
18 Mar 2024WP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Service5.3<= 9.0.349.0.3515
12 Mar 2024WP Go Maps <= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 9.0.329.0.332
12 Mar 2024WP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 9.0.329.0.332
23 Jan 2024WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting6.1<= 9.0.289.0.29Patched before disclosure
18 Dec 2023WP Google Maps <= 9.0.27 - Unauthenticated Stored Cross-Site Scripting via REST API6.1<= 9.0.279.0.2824
20 Jan 2023WP Go Maps <= 9.0.15 - Authenticated (Admin+) Directory Traversal4.9<= 9.0.159.0.16Patched before disclosure
8 Sep 2021WP Google Maps <= 8.1.12 - Authenticated Stored Cross-Site Scripting5.5< 8.1.138.1.13n/a
7 Jun 2021WP Google Maps <= 8.1.11 - Authenticated Stored Cross-Site Scripting5.4< 8.1.128.1.128
9 Sep 2020WP Go Maps (formerly WP Google Maps) <= 7.11.17 - SQL Injection9.8<= 7.11.177.11.18Patched before disclosure
8 Jul 2019WP Google Maps <= 7.11.34 - Cross-Site Request Forgery to Cross-Site Scripting6.1< 7.11.357.11.35n/a

Changelog mentions of security fixes: 10.0.10 (security); 10.1.00 (security); 10.1.02 (security); 10.1.04 (security, SQL injection); 10.1.05 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

0% of 1 support threads resolved in the last 2 months.

Momentum

300,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP Go Maps
4 May 20263,629
11 May 2026116,136
18 May 202656,754
25 May 202614,289
1 Jun 2026114,333
8 Jun 2026119,501
15 Jun 2026216,361
22 Jun 202619,938
29 Jun 202613,459
6 Jul 2026141,033
13 Jul 202660,901
20 Jul 2026115,119
27 Jul 202624,555
3 Aug 202651,707
10 Aug 2026110,988
17 Aug 2026157,604
24 Aug 202619,974
31 Aug 2026121,780
7 Sep 202617,831
14 Sep 202637,605
21 Sep 202622,314
28 Sep 2026118,158
5 Oct 202652,199
12 Oct 202611,345
19 Oct 202615,692
26 Oct 202611,341
2 Nov 20261,616

Weekly downloads over the last 4 weeks are 85% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

API KEY for Google MapsScore 100 · 30,000+Maps Widget for Google MapsScore 100 · 20,000+Maps Plugin using Google Maps forScore 96 · 10,000+Leaflet MapScore 91 · 30,000+YaMaps for WordPress PluginScore 91 · 10,000+

Facts

Version10.1.10
AuthorWPGMaps
Added26 Jan 2012
Last updated28 Sep 2026
Active installs300,000+
Requires WordPress6.0
Tested up to7.1.4
Requires PHP7.0
CategoryE-commerce & Shopping
Tagsmap, maps, Google Maps, leaflet map, Store locator

Other plugins by this author: WP Go Maps Block

Questions

Is WP Go Maps still maintained?

Yes. Last release 28 Sep 2026, 29 releases in the last 24 months.

Who owns WP Go Maps, and has it changed hands?

Changed. New committer NickDuncan made a first commit on 1 Jun 2026.

Was WP Go Maps removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is WP Go Maps safe?

29 known vulnerabilities, all fixed (latest in 10.1.09). Not on the exploited list.

Is the latest WP Go Maps update safe to install?

No ownership change before 10.1.10. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue