MapPress – Google Maps, OpenStreetMap & Leaflet

MapPress – Google Maps, OpenStreetMap & Leaflet has 17 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; all 17 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2024 was the busiest year with 6 disclosures.

The most common weakness is Cross-Site Scripting, behind 11 of the records (65%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type, Authorization Bypass Through User-Controlled Key.

Every one of the 17 issues recorded for MapPress – Google Maps, OpenStreetMap & Leaflet has a vendor fix available, so running the current release closes all known holes.

14 independent researchers contributed these findings, most of them (3) reported by Akbar Kustirama. MapPress – Google Maps, OpenStreetMap & Leaflet is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891001.04.2009Today01.04.20206.5MapPress Maps for WordPress <=2.53.8 - Authenticated Map Creation/Deletion to Stored Cross-Site Scripting & Remote Code Execution CVSS 6.5 · 01.04.202028.05.20208.8MapPress Maps <= 2.54.5 - Remote Code Execution via Improper Capability Checks in AJAX Calls CVSS 8.8 · 28.05.202017.01.20226.1MapPress Maps <= 2.73.3 - Reflected Cross-Site Scripting CVSS 6.1 · 17.01.202214.03.20226.0MapPress Maps for WordPress <= 2.73.12 - Admin+ File Upload to Remote Code Execution CVSS 6.0 · 14.03.202206.04.20238.8MapPress Maps for WordPress <= 2.85.4 - Authenticated (Contributor+) SQL Injection via get_maps CVSS 8.8 · 06.04.202311.09.20236.4MapPress Maps for WordPress <= 2.88.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 11.09.202302.01.20246.4MapPress Maps for WordPress <= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 02.01.202417.01.20246.4MapPress Maps for WordPress <= 2.88.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 17.01.20245.3MapPress Maps for WordPress <= 2.88.15 - Insufficient Authorization to Information Disclosure CVSS 5.3 · 17.01.202429.01.20246.4MapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings CVSS 6.4 · 29.01.202424.09.20244.4MapPress Maps for WordPress <= 2.92.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 24.09.202405.11.20246.4MapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block CVSS 6.4 · 05.11.202413.03.20256.4MapPress Maps for WordPress <= 2.94.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 13.03.202527.03.20254.4MapPress Maps for WordPress <= 2.94.9 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 27.03.202505.06.20265.3MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints CVSS 5.3 · 05.06.202619.06.20267.2MapPress Maps for WordPress <= 2.97.3 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 19.06.202624.07.20265.3MapPress – Google Maps, OpenStreetMap & Leaflet <= 2.97.6 - Unauthenticated Information Exposure CVSS 5.3 · 24.07.2026

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

17

Get automatic notifications for all MapPress – Google Maps, OpenStreetMap & Leaflet vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2023-26015

MapPress Maps for WordPress <= 2.85.4 - Authenticated (Contributor+) SQL Injection via get_maps

Read the full analysis

Vulnerability Records

17 records
2026-07-24 00:00CVE-2026-65564
5.3
Medium
Ananda DhakalYes
2026-06-19 00:00CVE-2026-56011
7.2
High
l3m3sYes
2026-06-05 14:37CVE-2026-8839
5.3
Medium
KitchYes
2025-03-27 00:00CVE-2025-2162
4.4
Medium
Dmitrii IgnatyevYes
2025-03-13 00:00CVE-2025-2055
6.4
Medium
Dmitrii IgnatyevYes
2024-11-05 00:00CVE-2024-10715
6.4
Medium
Akbar KustiramaYes
2024-09-24 00:00CVE-2024-8620
4.4
Medium
KienttYes
2024-01-29 00:00CVE-2023-7225
6.4
Medium
Akbar KustiramaYes
2024-01-17 00:00CVE-2024-0420
6.4
Medium
Salvatore BovaYes
2024-01-17 00:00CVE-2024-0421
5.3
Medium
Erwan LRYes
Showing 1–10 of 17 reports
MapPress – Google Maps, OpenStreetMap & Leaflet banner
Latestv2.97.12

MapPress – Google Maps, OpenStreetMap & Leaflet

chrisvrichardson

Author

chrisvrichardson

4.7(148)
94/100
Last Updated
2026-09-12 (1d ago)
Active Installs
30,000+
Downloads
4,992,404
Requires WP
6.3+
Requires PHP
7.0+
Tested up to
WP 7.1
Created
2009-04-01 (18y ago)

MapPress is the easiest way to add beautiful interactive maps to WordPress, with Gutenberg map blocks and classic editor support. Create unlimited maps and markers in the free version, with no upgrade required. MapPress works the moment you activate it: no API key, no billing account, no configuration. Pick the map service that fits you: Google Maps, or free keyless Leaflet maps using OpenFreeMap (OpenStreetMap data) — no API key required. Mapbox is also supported. Perfect for contact pages, store and office locations, real estate listings, travel routes, delivery areas and directories. Upgrade to MapPress Pro for even more features, including custom icons (with a built-in icon editor!), search and filter, mashups, and much more. See it in action on the MapPress Home Page or test it yourself with a Free Demo Site! Home Page What’s New Documentation FAQ Support Key Features Unlimited maps and markers in free version No API key, no setup and no fees Google Maps, Leaflet, Mapbox, and free OpenFreeMap maps (using OpenStreetMap data) Gutenberg editor map blocks Classic editor support Styled maps Marker clustering Add maps to any post, page or custom post type Responsive maps Size maps by pixels, percent or viewport Popups with custom text, photos, images, and links Google overlays for traffic, bicycling and transit Directions from Google Maps Geocoders from Google, Nominatim, and Mapbox KML map overlays GPX tracks Draw polygons, circles, and lines Generate maps using PHP WPML compatible MultiSite compatible Pro Version Features Get MapPress Pro for additional functionality Build a searchable map or store locator with search, geolocation and filtering Custom markers upload Marker editor with thousands of icons, shapes and colors Gutenberg “mashup” block for searchable maps and store locators Map widget and mashup widget Customizable templates for markers and lists Generate maps automatically from custom fields Automatically assign marker icons by taxonomy, tag, or category Advanced Custom Fields (ACF) integration Localization Please Contact me to provide a translation. Many thanks to all the folks who have created and updated translations.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C