StoryMap Plugin

StoryMap Plugin has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.

None of the 2 issues recorded for StoryMap Plugin have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, one record each. StoryMap Plugin is installed on roughly 30 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage0%
Open

2

Fixed

0

Get automatic notifications for all StoryMap Plugin vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-58874

StoryMap <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
Plugin Profile
Latestv3.1

StoryMap Plugin

Josep Sitar

Author

Josep Sitar

5.0(1)
100/100
Last Updated
2026-10-21 (7d ago)
Active Installs
30+
Downloads
4,868
Requires WP
6.8+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2018-08-28 (8y ago)

Create Storymaps using native WordPress content and display an interactive map in the editor and on the public page. Each Storymap can use OpenStreetMap, satellite, hybrid, relief, cycling, or world street map tiles; the overview map always uses OpenStreetMap. Each Storymap can have an introductory description and image, shown at the start of the information panel. Public maps display the selected Storymap’s points connected in order by a red dashed line, with a small overview map in the lower-left showing the full extent of its points. The information panel contains the introduction and all points in order; scrolling through a point title centers the map on that point. Side arrows remain available to scroll through points in order, with directional slide transitions. On wide maps, the panel fills the map height on the right and the map keeps the selected point in the uncovered area; on mobile, the panel is placed at the bottom. Maps fill the screen width by default; enter a pixel width in Storymap settings to use a custom width. Map height uses the Storymap settings. Each Storymap has an independent story number, separate from its WordPress post ID. A page or post can contain multiple map blocks, each assigned to a different Storymap. The WordPress admin includes a Leaflet-based point form that saves points to the existing legacy points table, using the selected Storymap’s number in the legacy storyId field. We are continuously working on new developments and features. For personalized plugin development or other inquiries, contact: Keepyourphoto.com See an example at keepyourphoto

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C