Maps for WP
Maps for WP has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; 2 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.7, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 3 of the records (100%).
2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
3 independent researchers contributed these findings, one record each. Maps for WP is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2025-57952Maps for WP <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Maps for WP
Author
icopydoc
woocommerceA handy plugin for inserting Yandex and Google maps using shortcode. Adds Yandex or Google Map with one point [MapOnePoint id=”” type=”” lon=”” lat=”” zoom=”” h=”” img=”” thover=”” tclick=””] “id” (required) – unique id “type” (not required) – map layer (roadmap, satellite, hybrid, terrain) “lon” (required) – longitude of the center of the map “lat” (required) – latitude of the center of the map “mstyle” (not required) – style of maps (default, blackwhite, blackout, сolorinversion) “h” (not required) – Map height in pixels “img” (not required) – URL image markers “thover” (not required) – Text when pointing to a point “tclick” (not required) – Text when clicking on a point Example: [MapOnePoint id="m1" type="hybrid" lon="55.75197479670444" lat="37.617726067459024" zoom="5" h="200" img="http://site.ru/1.png" thover="Text when pointing to a point" tclick="Text when clicking on a poin. Some text"] Adds Yandex or Google map with many points [MapManyPoints id=”” type=”” lat=”” lon=”” zoom=”” h=”” img=”” points=””] “id” (required) – unique id “type” (not required) – map layer (roadmap, satellite, hybrid, terrain) “lon” (required) – longitude of the center of the map “lat” (required) – latitude of the center of the map “mstyle” (not required) – style of maps (default, blackwhite, blackout, сolorinversion) “h” (not required) – Map height in pixels “img” (not required) – URL image markers “points” – [lat point 1],[lon point 1],[text on hover 1],[text on click 1];[lat point 2],[lon point 2],[text on hover 2],[text on click 2] and so on… Example: [[MapManyPoints id="m2" type="roadmap" lat="25" lon="30" zoom="2" h="250" points="25,-1,Text on hover this point, Text on click this point;-5,13,Text on hover this point, Text on click this point"]
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C