GPX Viewer

GPX Viewer has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Missing Authorization, behind 1 of the records (50%). Other recurring categories include Path Traversal.

Every one of the 2 issues recorded for GPX Viewer has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. GPX Viewer is installed on roughly 900 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.8/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all GPX Viewer vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2024-10629

GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation

Read the full analysis

Vulnerability Records

2 records
Plugin Profile
Latestv2.3.1
3.8(8)
76/100
Last Updated
2026-09-06 (6d ago)
Active Installs
900+
Downloads
28,003
Requires WP
4.9+
Requires PHP
7.2.24+
Tested up to
WP 7.1
Created
2018-09-07 (8y ago)

Displays a GPX track as segmented polylines, the way points and the elevation profile. Open Street Map (OSM) is used as background which can be switched between a plane view and a topographic one. The view can be changed to full screen mode. Moving the cursor over the elevation profile the corresponding point is marked on the path interactively. GPX tracks uploaded to the server in advance are stored into separate repositories that are ordered according to the categories setup in wordpress. Thus different collections of tracks can be handled and the tracks choosen from. During upload a GPX track can be smoothed and/or its elevation data replaced by Open-Elevation Service data. The latter is provided because many elevation data tracked by mobiles are not quite correct. GPX trackpoints can be edited on the map interactively. Features Admin page GPX Files for uploading tracks – Selecting category for repository – Replacing the description of the track (tag <name> in the GPX file) – Smoothing tracks during upload, thus reducing track points – Replacing elevation data of track points using Open-Elevation Service during upload Display of a specific, uploaded GPX track – PHP-function for inserting the view into a page – Selecting full screen mode and scaling the map – Switching between plane and topographic view Editing trackpoints on the map – Adding, moving, deleting track points – creating, splitting polylines Display of a list of GPX files from which a track can be selected – separated list for each category – Setting width and color of the path – Shortcode for inserting the list into a page Elevation profile – Interactive path marker – Name of the track – Distance of the track – Maximum/minimum elevation – Elevation loss/gain – Trail duration

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C