Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key

Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 10 are fixed as of October 2026. Their average CVSS score is 6.0, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 4 high. 2026 was the busiest year with 6 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (40%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).

Every one of the 10 issues recorded for Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, most of them (3) reported by Asim Alshaya. Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
6.0/ 10
Patch Coverage100%
Open

0

Fixed

10

Get automatic notifications for all Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2026-73376

Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated PHP Object Injection

Read the full analysis

Vulnerability Records

10 records
2026-09-30 13:42CVE-2026-102397
5.3
Medium
Peter TangYes
2026-09-30 09:59CVE-2026-102396
7.2
High
neurotxYes
2026-09-03 00:00CVE-2026-85309
5.3
Medium
Supakiad S. (m3ez)Yes
2026-08-18 00:00CVE-2026-73376
8.1
High
Asim AlshayaYes
2026-08-18 00:00CVE-2026-73375
7.2
High
Asim AlshayaYes
2026-08-18 00:00CVE-2026-73377
5.3
Medium
Asim AlshayaYes
2024-04-05 00:00CVE-2024-31271
4.3
Medium
Steven JulianYes
2024-01-12 00:00CVE-2023-6732
4.4
Medium
Mert UmutYes
2021-04-19 00:00CVE-2021-24274
6.1
Medium
0xB9Yes
2021-02-08 00:00N/A
7.2
High
AnonymousYes
Showing 1–10 of 10 reports
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key banner
Latestv1.6.4

Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key

supsystic

Author

supsystic

4.6(86)
92/100
Last Updated
2026-10-16 (12d ago)
Active Installs
10,000+
Downloads
369,359
Requires WP
0+
Requires PHP
7.3+
Tested up to
WP 7.1.3
Created
2018-10-18 (8y ago)

Ultimate Maps by Supsystic is a WordPress map plugin for interactive OpenStreetMap maps built on Leaflet. Add unlimited maps and markers, describe each place with text, photos and video, group markers into categories with a filter and cluster them when they crowd together. It works out of the box without a Google Maps API key, and your pages make no requests to Google. Want a different look? Switch the same map to Mapbox, Thunderforest, Bing Maps or your own tile server without rebuilding a single marker. Try it in your browser: open a live demo in WordPress Playground – no install, no account. OpenStreetMap without an API key OpenStreetMap tiles load through Leaflet with no key and no account. Pick the style that suits your site: OpenStreetMap Standard, Germany and Humanitarian OpenTopoMap, CyclOSM and OpenHikingMap for outdoor, cycling and hiking maps Public transport and railway maps OpenFreeMap vector styles: Positron, Bright, Liberty, Dark and Fiord CartoDB Positron More map providers Mapbox: streets, outdoors, light, dark and satellite (free access token) Thunderforest: OpenCycleMap, outdoors, landscape and transport (free API key) Bing Maps: road, aerial, bird’s eye and canvas (Bing Maps key) MapTiles API (OpenStreetMap) through RapidAPI Any custom or self-hosted Leaflet tile server Change the provider of an existing map at any time. Your markers stay where they are. Unlimited maps and markers Markers with text, photos, video, links, phone and e-mail Custom marker icons from the built-in library or your own image Marker categories with a front-end filter Marker clustering for maps with many locations Linked markers that open any URL on click Address search: type an address and get the pin Map settings Width, height, zoom, minimum and maximum zoom Scroll-wheel and drag behaviour, navigation bar and zoom controls Responsive maps with touch controls A starter set of map themes Add maps anywhere Gutenberg block, Elementor widget, sidebar widget, shortcode and PHP snippet Works with WPBakery, Divi, Beaver Builder and other page builders through the shortcode Moving from Google Maps Import maps from our Easy Google Maps plugin and keep your markers. Move maps and markers between sites with CSV import and export. Privacy Ultimate Maps makes no requests to Google. Map tiles load only from the provider you choose for each map. Made for Contact page and office location maps Businesses with several branches or dealers Real estate and rental listings Hiking, cycling and travel maps Event venues, campuses and city guides Ultimate Maps Pro Pro adds layers, shapes and richer ways to present your locations: Shapes: polygons, polylines and circles with fill and descriptions KML layers from a file or URL, and KML points imported as markers Heatmap layer Table view: a searchable, sortable list of locations Horizontal and vertical photo sliders and an exposition slider next to the map Visitors can add markers from the front end Markers shown only between two dates The full collection of map themes Learn more Official plugin page Pro features Pricing Documentation

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C