StoryMap Plugin
StoryMap Plugin has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.
None of the 2 issues recorded for StoryMap Plugin have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. StoryMap Plugin is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2025-58874StoryMap <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
StoryMap Plugin
Author
josepsitjar
This plugin makes it easy to create interactive storymaps directly on your WordPress site. You can define all the characteristics of your stories (title, basemap) and their associated points (title, description, image, position, zoom level) in an intuitive way. Using a simple shortcode, your storymaps will automatically be displayed on your site. We are continuously working on new developments and features. For personalized plugin development or other inquiries, contact: Keepyourphoto.com See an example at keepyourphoto
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C