WordPress plugin
MapPress – Free Map Plugin for Google Maps & OpenStreetMap security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 18 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High3
- Medium15
- Low0
All MapPress – Free Map Plugin for Google Maps & OpenStreetMap vulnerabilities
- Medium5.3Unauthenticated Information Exposure
≤2.97.14Update to 2.97.15
- Medium5.3Unauthenticated Information Exposure
≤2.97.6Update to 2.97.7
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.97.3Update to 2.97.4
- Medium5.3Unauthenticated Insecure Direct Object Reference via REST API Endpoints
≤2.96.6Update to 2.97.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤2.94.9Update to 2.94.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.94.8Update to 2.94.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block
≤2.94.1Update to 2.94.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤2.92.2Update to 2.93
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings
≤2.88.16Update to 2.88.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.88.14Update to 2.88.15
- Medium5.3Insufficient Authorization to Information Disclosure
≤2.88.15Update to 2.88.16
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.88.13Update to 2.88.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤2.88.4Update to 2.88.5
- High8.8Authenticated (Contributor+) SQL Injection via get_maps
≤2.85.4Update to 2.85.5
- Medium6.0Admin+ File Upload to Remote Code Execution
<2.73.13Update to 2.73.13
- Medium6.1Reflected Cross-Site Scripting
<2.73.4Update to 2.73.4
- High8.8Remote Code Execution via Improper Capability Checks in AJAX Calls
≤2.54.5Update to 2.54.6
- Medium6.5Authenticated Map Creation/Deletion to Stored Cross-Site Scripting & Remote Code Execution
<2.53.9Update to 2.53.9
MapPress – Free Map Plugin for Google Maps & OpenStreetMap: common questions
Does MapPress – Free Map Plugin for Google Maps & OpenStreetMap have known vulnerabilities?
Yes. VulnCrest Radar lists 18 known vulnerabilities in MapPress – Free Map Plugin for Google Maps & OpenStreetMap: 3 high, 15 medium. None are known to affect version null.
How do I check which version of MapPress – Free Map Plugin for Google Maps & OpenStreetMap I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent MapPress – Free Map Plugin for Google Maps & OpenStreetMap vulnerability?
CVE-2026-118168, published Oct 30, 2026: MapPress Maps for WordPress <= 2.97.14 - Unauthenticated Information Exposure. Severity: Medium (CVSS 5.3).
Is any MapPress – Free Map Plugin for Google Maps & OpenStreetMap vulnerability listed in CISA KEV?
No. None of the known MapPress – Free Map Plugin for Google Maps & OpenStreetMap vulnerabilities is currently listed in the CISA KEV catalog.