WordPress plugin

Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key security & vulnerabilities

Q: Does Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key have known vulnerabilities?

Yes. VulnCrest Radar lists 10 known vulnerabilities in Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key: 4 high, 6 medium. None are known to affect version null.

Q: How do I check which version of Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key vulnerability?

CVE-2026-102397, published Sep 30, 2026: Ultimate Maps by Supsystic <= 1.5.5 - Missing Authorization. Severity: Medium (CVSS 5.3).

Q: Is any Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key vulnerability listed in CISA KEV?

No. None of the known Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key vulnerabilities is currently listed in the CISA KEV catalog.

ultimate-maps-by-supsystic— active installsLast vulnerability Sep 30, 2026

No known unpatched vulnerabilities in the latest version

All 10 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

10Known vulnerabilities

Critical0
High4
Medium6
Low0

Vulnerabilities per year

All Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key vulnerabilities

Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key vulnerabilities
Severity	Vulnerability	CVE	Published
High7.2	Unauthenticated Stored Cross-Site Scripting ≤1.5.5Update to 1.6.1	CVE-2026-102396	Sep 30
High7.2	Unauthenticated Stored Cross-Site Scripting <1.5.0Update to 1.5.0	CVE-2026-73375	Aug 18
High8.1	Unauthenticated PHP Object Injection <1.5.0Update to 1.5.0	CVE-2026-73376	Aug 18
High7.2	Authenticated SQL Injection <1.1.17Update to 1.1.17	—	Feb 8, 2021

High7.2
Unauthenticated Stored Cross-Site Scripting
≤1.5.5Update to 1.6.1
CVE-2026-102396Sep 30
High7.2
Unauthenticated Stored Cross-Site Scripting
<1.5.0Update to 1.5.0
CVE-2026-73375Aug 18
High8.1
Unauthenticated PHP Object Injection
<1.5.0Update to 1.5.0
CVE-2026-73376Aug 18
High7.2
Authenticated SQL Injection
<1.1.17Update to 1.1.17
758e23e4-72e6-4dc1-94f9-d02b75bb9857Feb 8, 2021

Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key: common questions

Does Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key have known vulnerabilities?

Yes. VulnCrest Radar lists 10 known vulnerabilities in Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key: 4 high, 6 medium. None are known to affect version null.

How do I check which version of Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key vulnerability?

CVE-2026-102397, published Sep 30, 2026: Ultimate Maps by Supsystic <= 1.5.5 - Missing Authorization. Severity: Medium (CVSS 5.3).

Is any Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key vulnerability listed in CISA KEV?

No. None of the known Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key vulnerabilities is currently listed in the CISA KEV catalog.