StoryMap Plugin
StoryMap Plugin has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.
None of the 2 issues recorded for StoryMap Plugin have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. StoryMap Plugin is installed on roughly 30 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-58874StoryMap <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
StoryMap Plugin
Author
Josep Sitar
Create Storymaps using native WordPress content and display an interactive map in the editor and on the public page. Each Storymap can use OpenStreetMap, satellite, hybrid, relief, cycling, or world street map tiles; the overview map always uses OpenStreetMap. Each Storymap can have an introductory description and image, shown at the start of the information panel. Public maps display the selected Storymap’s points connected in order by a red dashed line, with a small overview map in the lower-left showing the full extent of its points. The information panel contains the introduction and all points in order; scrolling through a point title centers the map on that point. Side arrows remain available to scroll through points in order, with directional slide transitions. On wide maps, the panel fills the map height on the right and the map keeps the selected point in the uncovered area; on mobile, the panel is placed at the bottom. Maps fill the screen width by default; enter a pixel width in Storymap settings to use a custom width. Map height uses the Storymap settings. Each Storymap has an independent story number, separate from its WordPress post ID. A page or post can contain multiple map blocks, each assigned to a different Storymap. The WordPress admin includes a Leaflet-based point form that saves points to the existing legacy points table, using the selected Storymap’s number in the legacy storyId field. We are continuously working on new developments and features. For personalized plugin development or other inquiries, contact: Keepyourphoto.com See an example at keepyourphoto
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C