Travelers' Map
Travelers' Map has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for Travelers' Map has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Travelers' Map is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-66098Travelers' Map <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Travelers' Map
Author
Camille V
Travelers’ Map allows you to display your blog posts on a dynamic map using the Leaflet module and OpenStreetMap open data. This plugin is entirely free. See this plugin in action on my hiking blog. How to use: Get started with Travelers’ Map Developers documentation Features of Travelers’ Map Geolocalize your posts, pages or custom post types on a map and choose the marker image. A search module is available to quickly locate the desired location. Add your own images to customize your markers. Insert a dynamic map that displays your articles using a simple shortcode. Choose the dimensions of your map. Filter the posts you want to display on the map by their type, categories and tags. Markers clustering is automatic when marker density is too high, to prevent them from overlapping. Customize the appearance of your maps with OpenStreetMap tile providers. By default, the plugin uses CARTO’s free and open “Voyager” map tiles. Customize the popup style and content for your markers. You can also disable the plugin’s CSS if you want to design your own popups. Travelers’ Map is compatible with the new Gutenberg editor and the classic editor. This plugin does not add any tables into your database. The geolocation data of your posts are saved as meta-data and are not deleted if Travelers’ Map is disabled or deleted. However, if you want to uninstall Travelers’ Map permanently, an option is available to clean your database of any data added by the plugin. Bug reports and Contribution Bug reports for Travelers’ map are welcomed on my GitHub Repository. Also, feel free to use Github to contribute to the plugin! Known Issues Minor issue with Elementor: Map preview in Elementor Builder is not working. However the map is still working on the final page.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C