Known vulnerabilities in MapPress – Google Maps, OpenStreetMap & Leaflet

Unlimited maps and markers. Free, no API key, no setup. Google Maps, Leaflet, OpenStreetMap & Mapbox. Map editor, blocks and store locators.

12Reported vulnerabilities

9.8Highest CVSS score

2.97.9Latest version

30,000+Active installs

What to do now

Update MapPress – Google Maps, OpenStreetMap & Leaflet to 2.97.7 or later. 12 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 16, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2020-12077	High 8.8	5.6%	Before 2.53.9	`2.53.9`	April 23, 2020
CVE-2023-26015	Critical 9.8	0.7%	2.85.4 and earlier	`2.85.5`	November 3, 2023
CVE-2020-12675	High 8.8	2.8%	Before 2.54.6	`2.54.6`	May 29, 2020
CVE-2026-56011	High 7.1	0.3%	2.97.3 and earlier	`2.97.4`	June 26, 2026
CVE-2025-2055	Medium 6.4	0.5%	2.94.8 and earlier	`2.94.9`	March 13, 2025
CVE-2023-6524	Medium 6.4	0.5%	2.88.13 and earlier	`2.88.14`	January 2, 2024
CVE-2026-8839	Medium 5.3	1.0%	0 to 2.96.6 (inclusive)	`2.97.1`	June 6, 2026
CVE-2024-10715	Medium 5.4	0.3%	0 to 2.94.1 (inclusive)	`2.94.2`	November 6, 2024
CVE-2023-4840	Medium 5.4	0.5%	2.88.4 and earlier	`2.88.5`	September 12, 2023
CVE-2026-65564	Medium 5.3	0.2%	2.97.6 and earlier	`2.97.7`	July 27, 2026
CVE-2025-2162	Medium 4.4	0.4%	2.94.9 and earlier	`2.94.10`	March 27, 2025
CVE-2024-8620	Medium 4.4	0.3%	2.92.2 and earlier	`2.93`	September 24, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.