WP-Safety

MapPress – Google Maps, OpenStreetMap & Leaflet Security & Risk Analysis

wordpress.org/plugins/mappress-google-maps-for-wordpress

Add unlimited Google Maps, Leaflet & OpenStreetMap to WordPress. Create a map, map block or store locator — no API key needed for free maps.

30K active installs v2.97.7 PHP 7.0+ WP 6.2+ Updated Jul 22, 2026
google-mapsleafletmapboxmapsopenstreetmap
88
A · Safe
CVEs total16
Unpatched0
Last CVEJun 19, 2026
Plugin page Download
Safety Verdict

Is MapPress – Google Maps, OpenStreetMap & Leaflet Safe to Use in 2026?

Generally Safe

Score 88/100

MapPress – Google Maps, OpenStreetMap & Leaflet has a strong security track record. Known vulnerabilities have been patched promptly. It's a solid choice for most WordPress installations.

16 known CVEsLast CVE: Jun 19, 2026Updated 1mo ago
Risk Assessment

The mappress-google-maps-for-wordpress plugin v2.95.10 presents a mixed security posture. While it demonstrates good practices in several areas, including a high percentage of SQL queries using prepared statements and a significant number of properly escaped outputs, there are notable concerns. The presence of one AJAX handler without authentication checks creates an immediate attack vector. The use of the `unserialize` function, although flagged as a single instance, is inherently risky as it can lead to remote code execution if not handled with extreme care and validation, especially when dealing with untrusted input. The plugin's vulnerability history is a significant red flag, with a substantial number of known CVEs (14 total), including high and medium severity issues such as Cross-Site Scripting, Missing Authorization, SQL Injection, and Unrestricted File Uploads. Although no currently unpatched vulnerabilities are listed, the pattern of past vulnerabilities suggests a recurring weakness in input validation and authorization mechanisms. This historical context, combined with the identified code-level risks, points to an overall posture that requires careful consideration and prompt attention to mitigate potential threats.

Key Concerns

  • AJAX handler without authentication check
  • Use of dangerous function: unserialize
  • High number of known vulnerabilities (14)
  • Multiple high severity past vulnerabilities
  • Flows with unsanitized paths
Vulnerabilities
16 published

MapPress – Google Maps, OpenStreetMap & Leaflet Security Vulnerabilities

CVEs by Year

2 CVEs in 2020
2020
2 CVEs in 2022
2022
2 CVEs in 2023
2023
6 CVEs in 2024
2024
2 CVEs in 2025
2025
2 CVEs in 2026
2026
Patched Has unpatched

Severity Breakdown

High
3
Medium
13

16 total CVEs

CVE-2026-56011high · 7.2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

MapPress Maps for WordPress <= 2.97.3 - Unauthenticated Stored Cross-Site Scripting

Jun 19, 2026 Patched in 2.97.4 (5d)
CVE-2026-8839medium · 5.3Authorization Bypass Through User-Controlled Key

MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints

Jun 5, 2026 Patched in 2.97.1 (1d)
CVE-2025-2162medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

MapPress Maps for WordPress <= 2.94.9 - Authenticated (Administrator+) Stored Cross-Site Scripting

Mar 27, 2025 Patched in 2.94.10 (27d)
CVE-2025-2055medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

MapPress Maps for WordPress <= 2.94.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Mar 13, 2025 Patched in 2.94.9 (28d)
CVE-2024-10715medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

MapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block

Nov 5, 2024 Patched in 2.94.2 (1d)
CVE-2024-8620medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

MapPress Maps for WordPress <= 2.92.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Sep 24, 2024 Patched in 2.93 (248d)
CVE-2023-7225medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

MapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings

Jan 29, 2024 Patched in 2.88.17 (183d)
CVE-2024-0420medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

MapPress Maps for WordPress <= 2.88.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

Jan 17, 2024 Patched in 2.88.15 (66d)
CVE-2024-0421medium · 5.3Missing Authorization

MapPress Maps for WordPress <= 2.88.15 - Insufficient Authorization to Information Disclosure

Jan 17, 2024 Patched in 2.88.16 (66d)
CVE-2023-6524medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

MapPress Maps for WordPress <= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

Jan 2, 2024 Patched in 2.88.14 (210d)
CVE-2023-4840medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

MapPress Maps for WordPress <= 2.88.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Sep 11, 2023 Patched in 2.88.5 (134d)
CVE-2023-26015high · 8.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

MapPress Maps for WordPress <= 2.85.4 - Authenticated (Contributor+) SQL Injection via get_maps

Apr 6, 2023 Patched in 2.85.5 (292d)
CVE-2022-0537medium · 6Unrestricted Upload of File with Dangerous Type

MapPress Maps for WordPress <= 2.73.12 - Admin+ File Upload to Remote Code Execution

Mar 14, 2022 Patched in 2.73.13 (680d)
CVE-2022-0208medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

MapPress Maps <= 2.73.3 - Reflected Cross-Site Scripting

Jan 17, 2022 Patched in 2.73.4 (736d)
CVE-2020-12675high · 8.8Unrestricted Upload of File with Dangerous Type

MapPress Maps <= 2.54.5 - Remote Code Execution via Improper Capability Checks in AJAX Calls

May 28, 2020 Patched in 2.54.6 (1335d)
CVE-2020-12077medium · 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

MapPress Maps for WordPress <=2.53.8 - Authenticated Map Creation/Deletion to Stored Cross-Site Scripting & Remote Code Execution

Apr 1, 2020 Patched in 2.53.9 (1392d)
Version History

MapPress – Google Maps, OpenStreetMap & Leaflet Release Timeline

v2.97.7Current
v2.97.6
v2.97.5
v2.97.4
v2.97.31 CVE
CVE-2026-56011
v2.97.21 CVE
CVE-2026-56011
v2.97.11 CVE
CVE-2026-56011
v2.972 CVEs
CVE-2026-8839 CVE-2026-56011
v2.96.62 CVEs
CVE-2026-8839 CVE-2026-56011
v2.96.52 CVEs
CVE-2026-8839 CVE-2026-56011
v2.96.42 CVEs
CVE-2026-8839 CVE-2026-56011
v2.96.32 CVEs
CVE-2026-8839 CVE-2026-56011
v2.96.22 CVEs
CVE-2026-8839 CVE-2026-56011
v2.96.12 CVEs
CVE-2026-8839 CVE-2026-56011
v2.962 CVEs
CVE-2026-8839 CVE-2026-56011
v2.95.132 CVEs
CVE-2026-8839 CVE-2026-56011
v2.95.122 CVEs
CVE-2026-8839 CVE-2026-56011
v2.95.112 CVEs
CVE-2026-8839 CVE-2026-56011
v2.95.102 CVEs
CVE-2026-8839 CVE-2026-56011
v2.95.92 CVEs
CVE-2026-8839 CVE-2026-56011
Code Analysis
Analyzed Mar 16, 2026

MapPress – Google Maps, OpenStreetMap & Leaflet Code Analysis

Dangerous Functions
1
Raw SQL Queries
11
32 prepared
Unescaped Output
16
43 escaped
Nonce Checks
13
Capability Checks
24
File Operations
5
External Requests
2
Bundled Libraries
0

Dangerous Functions Found

unserialize$mapdata = unserialize($row->obj);mappress_db.php:103

SQL Query Safety

74% prepared43 total queries

Output Escaping

73% escaped59 total outputs
Data Flows · Security
2 unsanitized

Data Flow Analysis

6 flows2 with unsanitized paths
template_redirect (mappress.php:1078)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
1 unprotected

MapPress – Google Maps, OpenStreetMap & Leaflet Attack Surface

Entry Points17
Unprotected1

AJAX Handlers 15

authwp_ajax_mapp_dismissmappress.php:111
authwp_ajax_mapp_upgrademappress_db.php:7
authwp_ajax_mapp_get_postmappress_map.php:111
noprivwp_ajax_mapp_get_postmappress_map.php:112
authwp_ajax_mapp_license_checkmappress_settings.php:125
authwp_ajax_mapp_geocodemappress_settings.php:126
authwp_ajax_mapp_options_resetmappress_settings.php:127
authwp_ajax_mapp_option_savemappress_settings.php:128
authwp_ajax_mapp_options_savemappress_settings.php:129
authwp_ajax_mapp_preferences_savemappress_settings.php:130
authwp_ajax_mapp_style_deletemappress_settings.php:131
authwp_ajax_mapp_style_savemappress_settings.php:132
authwp_ajax_mapp_tpl_getmappress_template.php:21
authwp_ajax_mapp_tpl_savemappress_template.php:22
authwp_ajax_mapp_tpl_deletemappress_template.php:23

Shortcodes 2

[mappress] mappress.php:82
[mashup] mappress.php:100
WordPress Hooks 36
actionadmin_menumappress.php:78
actioninitmappress.php:79
actionplugins_loadedmappress.php:80
actionadmin_noticesmappress.php:83
filterthe_contentmappress.php:86
actionwp_headmappress.php:89
actionadmin_headmappress.php:90
actionwp_enqueue_scriptsmappress.php:93
actionadmin_enqueue_scriptsmappress.php:94
filterscript_loader_tagmappress.php:104
filterheartbeat_settingsmappress.php:108
filterblock_categories_allmappress.php:115
filterblock_categoriesmappress.php:117
filtermime_typesmappress.php:119
actionadmin_initmappress.php:124
actiontemplate_redirectmappress.php:128
filterwp_img_tag_add_decoding_attrmappress.php:132
filterscript_loader_tagmappress.php:845
actionrest_api_initmappress_api.php:6
filtercmplz_known_script_tagsmappress_compliance.php:13
filtercmplz_detected_servicesmappress_compliance.php:15
filtercmplz_whitelisted_script_tagsmappress_compliance.php:16
actiondeleted_postmappress_map.php:114
actiontrashed_postmappress_map.php:115
actionmedia_buttonsmappress_map.php:116
actionshow_user_profilemappress_map.php:118
actionedit_user_profilemappress_map.php:119
actiondeleted_usermappress_map.php:120
actionload-toplevel_page_mappressmappress_settings.php:133
actionadmin_print_scriptsmappress_template.php:27
actionadmin_print_footer_scriptsmappress_template.php:28
actionwp_print_scriptsmappress_template.php:32
actionwp_footermappress_template.php:33
actionmappress_map_savemappress_wpml.php:5
actionmappress_map_displaymappress_wpml.php:6
actionwpml_pro_translation_completedmappress_wpml.php:10
Maintenance & Trust

MapPress – Google Maps, OpenStreetMap & Leaflet Maintenance & Trust

Maintenance Signals

WordPress version tested7.0.2
Last updatedJul 22, 2026
PHP min version7.0
Downloads4.9M

Community Trust

Rating94/100
Number of ratings146
Active installs30K
Alternatives

MapPress – Google Maps, OpenStreetMap & Leaflet Alternatives

Out of the Block: OpenStreetMap

Out of the Block: OpenStreetMap

ootb-openstreetmap

A
99

A map block for Gutenberg using OpenStreetMap and Leaflet that needs no API keys and works out of the box. Or should we say, ...Out of the Block?

800 1 CVE
Easy Map- Store Locator Plugin for WordPress (No API Key Required)

Easy Map- Store Locator Plugin for WordPress (No API Key Required)

easy-map

A
100

Create store locator maps, multiple markers, drawings, and interactive WordPress maps with OpenStreetMap, Google Maps, Bing Maps, and Leaflet.

70 No CVEs
Slick Google Map

Slick Google Map

slick-google-map

A
99

Embed Google Maps (with your own API key) or OpenStreetMap/Leaflet maps via shortcode or Gutenberg block.

50 1 CVE
Simple Map Locator

Simple Map Locator

simple-map-locator

A
100

Interactive maps and markers on your posts and pages with simple shortcodes.

10 No CVEs
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map

WP Go Maps – Google Map, OpenStreetMap, Leaflet Map

wp-google-maps

A
86

The easiest to use WordPress map plugin! Create a custom map, map block, store locator or map widget with high quality markers.

300K 25 CVEs
Developer Profile

MapPress – Google Maps, OpenStreetMap & Leaflet Developer Profile

chrisvrichardson

1 plugin · 30K total installs

71
trust score
Avg Security Score
88/100
Avg Patch Time
338 days
View full developer profile
Detection Fingerprints

How We Detect MapPress – Google Maps, OpenStreetMap & Leaflet

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/mappress-google-maps-for-wordpress/css/mappress.css/wp-content/plugins/mappress-google-maps-for-wordpress/css/mappress-admin.css/wp-content/plugins/mappress-google-maps-for-wordpress/css/mappress-blocks.css/wp-content/plugins/mappress-google-maps-for-wordpress/css/mappress-editor.css/wp-content/plugins/mappress-google-maps-for-wordpress/js/mappress.js/wp-content/plugins/mappress-google-maps-for-wordpress/js/mappress-admin.js/wp-content/plugins/mappress-google-maps-for-wordpress/js/mappress-blocks.js/wp-content/plugins/mappress-google-maps-for-wordpress/js/mappress-editor.js+5 more
Version Parameters
mappress-google-maps-for-wordpress/css/mappress.css?ver=mappress-google-maps-for-wordpress/css/mappress-admin.css?ver=mappress-google-maps-for-wordpress/css/mappress-blocks.css?ver=mappress-google-maps-for-wordpress/css/mappress-editor.css?ver=mappress-google-maps-for-wordpress/js/mappress.js?ver=mappress-google-maps-for-wordpress/js/mappress-admin.js?ver=mappress-google-maps-for-wordpress/js/mappress-blocks.js?ver=mappress-google-maps-for-wordpress/js/mappress-editor.js?ver=mappress-google-maps-for-wordpress/js/mappress-poi.js?ver=mappress-google-maps-for-wordpress/js/mappress-import.js?ver=mappress-google-maps-for-wordpress/js/mappress-map.js?ver=mappress-google-maps-for-wordpress/js/mappress-settings.js?ver=mappress-google-maps-for-wordpress/js/mappress-welcome.js?ver=

HTML / DOM Fingerprints

CSS Classes
mappress-map-canvasmappress-blockmappress-shortcodemappress-overlaymappress-sidebarmappress-editor-wrappermappress-poi-previewmappress-settings-form+3 more
HTML Comments
<!-- MAPPRESS_START --><!-- MAPPRESS_END --><!-- MAPPRESS_MAP_START --><!-- MAPPRESS_MAP_END -->
Data Attributes
data-mappressiddata-mappress-optionsdata-mappress-mapiddata-mappress-poiid
JS Globals
Mappressmappress
Shortcode Output
[mappress][mashup]
FAQ

Frequently Asked Questions about MapPress – Google Maps, OpenStreetMap & Leaflet