What WP Go Maps does on your site
WP Go Maps (formerly WP Google Maps) lets you build interactive maps in the WordPress admin, under the Maps menu, and display them with a Gutenberg block, an Elementor widget, a classic widget or a shortcode. You add markers by typing an address or right-clicking the map, draw polygons and polylines (a delivery zone, a route), and can turn on a store locator that finds the points closest to an address the visitor enters.
Despite its old name, the plugin does not tie you to Google Maps. You pick the engine in the settings: Google Maps (with a Google API key), Leaflet, OpenLayers, Azure Maps, Stadia Maps, Maptiler, LocationIQ, or a “zero cost” preset that combines Leaflet, OpenFreeMap tiles and Nominatim geocoding, with no key and no credit card. Markers live in the WordPress database, so switching engines does not erase them.
The developer, CodeCabin, sells a Pro add-on that you install alongside the free plugin. It adds multiple maps per site, descriptions, images and links in markers, categories, directions, marker listings and CSV, KML or KMZ import. Two separate add-ons, Gold (marker clustering, ratings) and VGM (visitor-generated markers), come with the 5-site and unlimited licenses.
Which sites WP Go Maps is a good fit for
WP Go Maps makes sense when the map is part of your content and should be managed from WordPress:
- Local businesses and branch networks: a single map with every location plus a store locator is often enough, and both are free.
- Sites that want to avoid Google billing: the zero cost preset shows an OpenStreetMap map without a Google Cloud account.
- Directories, event sites and WooCommerce stores: Pro adds filterable categories, CSV import, ACF fields and WooCommerce products placed on the map.
It is not the best pick if all you show is one address on your Contact page: a simple embedded map saves you one more plugin to keep updated. It is not ideal either if you want several maps and full location details without paying, since those features are Pro only.
WP Go Maps strengths and limitations
Strengths
- A generous free version. Unlimited markers, polygons, polylines, map themes and a store locator at no cost.
- Your choice of engine. Google Maps is just one option; Leaflet and the zero cost preset work without an API key.
- A one-time payment. The Pro license is not a subscription: version 10 stays usable and keeps getting security fixes with no recurring fee.
- Built-in consent. One option blocks the map API until the visitor agrees, and Complianz can take over that control.
Limitations
- One map on the free plan. The button to create a new map is reserved for Pro.
- Bare markers without Pro. Descriptions, images, links, categories and directions are paid features, as is CSV or KML import.
- Clustering sold separately. Marker clustering comes from the Gold add-on, which the single-site license does not include.
- A long list of security fixes. Several flaws exploitable without an account were patched in 2026, so updates need close attention.
The WP Go Maps settings we recommend
These settings exist in the current free version, under Maps > Settings, with the same tabs whichever interface you use (Atlas Novus or Atlas Major). Save, then run the checks below.
| Setting | Recommended value | Why |
|---|---|---|
| Maps Engine Maps > Settings > General | Google Maps with an API key restricted to your domain, or “Zero Cost Mapping Preset” | Without a valid key Google will not show the map; the zero cost preset needs none. |
| Require consent before loading Maps API Maps > Settings > GDPR Compliance | On if you have visitors in the EU | The map sends the visitor’s IP address to the tile provider; when Complianz is active, it controls this setting instead. |
| Lowest Access Level Maps > Settings > Advanced | Admin (default) | The plugin warns that a lower role could manage custom JavaScript scripts. |
| Load Maps Engine API Same tab | Where required (default) | “Always” loads the map scripts on every page, even pages without a map. |
| Address Provider Same tab | Engine Default, or a keyed provider on a busy site | The plugin points out that Nominatim has strict usage limits and throttles high-traffic sites. |
| Disable Mouse Wheel Zoom Maps > Settings > General | On for long pages | Visitors scrolling down the page do not get stuck inside the map. |
- Open the map page in a private window: with consent turned on, the notice should appear before the map.
- With Google Maps, open the browser console on that page: no API key error should show up.
- If the map disappears after you enable minification or script deferral, exclude the
wp-google-mapsscripts from those optimizations, as the developer recommends. - In Plugins, check that WP Go Maps is at version 10.1.09 or later.
WP Go Maps security: unauthenticated flaws, patched by the developer
The Patchstack database lists more than thirty patched vulnerabilities in WP Go Maps. What matters most: the plugin exposes public REST API routes and AJAX actions to display maps, and several flaws could be exploited by an anonymous visitor. The most notable ones:
- CVE-2019-10692, fixed in 7.11.18: unauthenticated SQL injection, because the REST API did not sanitize field names.
- CVE-2025-11307, fixed in 9.0.48: unauthenticated stored XSS through an AJAX action whose data was later output without escaping.
- CVE-2026-4268, versions up to 10.0.05: a mere subscriber could save JavaScript in the settings because of a missing capability check.
- CVE-2026-12238, versions up to 10.1.01: creation of records (maps, markers, shapes) without an account.
- CVE-2026-15381, fixed in 10.1.04: another unauthenticated SQL injection, through the REST API marker filter.
Version 10.1.09 also fixes a denial of service triggered by an anonymous request, so treat it as the minimum. Turn on automatic plugin updates for WP Go Maps, because these flaws target requests that are easy to automate. WP Masquerade Pro hides the /wp-content/plugins/wp-google-maps/ folder address and the plugin’s tag IDs, while the WPGMZA JavaScript variable and the wpgmza classes stay visible because the map needs them; this makes the plugin harder for bots hunting these flaws to spot, but it is no substitute for updating.
What WP Masquerade hides for WP Go Maps
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to WP Go Maps: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- JavaScript variables
WPGMZA, wpgmza_* - CSS classes
wpgmza*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
WP Go Maps frequently asked questions
Do I need a Google API key to use WP Go Maps?
Only if you choose the Google Maps engine. Leaflet, OpenLayers and the zero cost preset work without a Google key, and you can switch engines later without losing your markers.
Is the free version of WP Go Maps enough?
For a map of your locations with a store locator, yes. You need Pro as soon as you want several maps, marker details with text, image and link, categories or a file import.
How much does WP Go Maps Pro cost, and is it a subscription?
No, it is a one-time payment. The official page lists $69 for one site, $99 for five sites with the Gold and VGM add-ons, and $299 for unlimited sites with future major versions. The first two licenses cover version 10; the next major version will be offered at 50% off.
Is WP Go Maps GDPR compliant?
The plugin offers a consent notice that blocks the map API until the visitor agrees, with your company name and the purpose of processing. If you use Complianz, it manages that consent instead.