CVE-2014-9686: The Googlemaps plugin 3.2 and earlier for Joomla!

Security readout for executives and security teams

CVE-2014-9686 affects Googlemaps plugin 3.2 and earlier for Joomla. A remote attacker who controls a subdomain under the victim domain may trigger denial of service through the plugin's KML proxy URL handling. The issue is tied to an incomplete fix for CVE-2013-7428. Exposure is likely limited to Joomla sites running Googlemaps plugin 3.2 or earlier with the KML proxy endpoint reachable. Risk increases where abandoned, delegated, or attacker-controlled subdomains exist under the same domain. Prioritize remediation for public Joomla sites that still use this legacy plugin, especially where subdomain ownership is weak. The main business impact is service disruption, not data theft based on the provided sources. Mitigation focus: Inventory Joomla sites for Googlemaps plugin 3.2 or earlier.; Check vendor or project guidance for fixed versions or replacement recommendations.; Disable or restrict plugin_googlemap3_kmlprxy.php if the KML proxy is unused..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.