MapPress Maps for WordPress Vulnerability- Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2023-7225 |WordPress Plugin Vulnerability Report

Plugin Name: MapPress Maps for WordPress

Key Information:

  • Software Type: Plugin
  • Software Slug: mappress-google-maps-for-wordpress
  • Software Status: Active
  • Software Author: chrisvrichardson
  • Software Downloads: 4,193,183
  • Active Installs: 50,000
  • Last Updated: February 2, 2024
  • Patched Versions: 2.88.17
  • Affected Versions: <= 2.88.16

Vulnerability Details:

  • Name: MapPress <= 2.88.16
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2023-7225
  • CVSS Score: 6.4
  • Publicly Published: January 29, 2024
  • Researcher: Akbar Kustirama
  • Description: The MapPress Maps for WordPress plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability through the width and height parameters in map settings for all versions up to and including 2.88.16. Due to insufficient input sanitization and output escaping, authenticated users with contributor level access or higher can embed arbitrary web scripts into pages, which are executed when those pages are accessed by other users.


MapPress Maps for WordPress, a widely used mapping plugin, has been identified with a vulnerability in versions up to and including 2.88.16, which allows contributors and higher-level users to inject malicious scripts via map settings. This security issue has been effectively resolved in the latest version, 2.88.17.

Detailed Overview:

This vulnerability, discovered by security researcher Akbar Kustirama, poses a significant risk as it enables authenticated attackers to manipulate the width and height parameters within the map settings, leading to the injection and execution of harmful scripts. Such actions can compromise website integrity and user security, making it imperative for website administrators to apply the patch provided in version 2.88.17 promptly. The swift identification and rectification of this vulnerability underscore the ongoing challenges and necessities in maintaining web security.

Advice for Users:

Users of the MapPress Maps for WordPress plugin should immediately update to version 2.88.17 to mitigate this vulnerability. Website administrators are also advised to review their sites for any unusual activities or content that could indicate a compromise. In instances where updates cannot be applied promptly, consider deactivating the plugin temporarily or exploring alternative mapping solutions to maintain site security. Keeping all WordPress components up to date is essential for protecting against known vulnerabilities.


The quick response of the MapPress development team in addressing this vulnerability highlights the critical role of timely software updates in securing WordPress installations. By ensuring that the plugin is updated to version 2.88.17 or later, users can safeguard their websites against potential exploits stemming from this vulnerability, maintaining the trust and safety of their online presence.


In today's digital landscape, the security of your WordPress website is paramount, especially for small business owners who rely on their online presence to connect with customers. The recent identification of a vulnerability in the MapPress Maps for WordPress plugin, tagged as CVE-2023-7225, serves as a critical reminder of the ongoing need for vigilance in software maintenance. This vulnerability, which affects versions up to and including 2.88.16, allowed authenticated users to inject malicious scripts via map settings, posing significant risks to website integrity and user safety.

About the Plugin:

MapPress Maps for WordPress is a widely utilized plugin, enabling users to create interactive maps for their sites. With over 4 million downloads and 50,000 active installations, its influence is substantial. The plugin's developer, chrisvrichardson, has actively maintained it, with the latest update being version 2.88.17, which addresses the current security issue.

Vulnerability Details:

CVE-2023-7225 highlights a Stored Cross-Site Scripting (XSS) vulnerability within the plugin's map settings, specifically through the width and height parameters. This flaw was introduced due to inadequate input sanitization and output escaping, allowing attackers with contributor-level access to execute arbitrary web scripts. Publicly disclosed on January 29, 2024, by researcher Akbar Kustirama, this vulnerability received a CVSS score of 6.4, indicating a significant risk level.

Risks and Potential Impacts:

The exploitation of this vulnerability could lead to several adverse outcomes, including data breaches, unauthorized website access, and compromised user data. For small business owners, such breaches not only disrupt operations but can also erode customer trust and result in reputational damage.

Remediation and Advice for Users:

To mitigate this vulnerability, users are urged to update to version 2.88.17 of the MapPress Maps for WordPress plugin immediately. Additionally, website administrators should conduct a thorough review of their site for any signs of compromise and remain vigilant for unusual activities. In scenarios where immediate updates are not feasible, deactivating the plugin temporarily or exploring alternative mapping solutions can serve as interim protective measures.

Previous Vulnerabilities:

The MapPress plugin has encountered seven vulnerabilities since April 1, 2020, underscoring the importance of regular monitoring and updating of all WordPress components to defend against emerging threats.


For small business owners, the challenge of staying abreast of every potential security vulnerability can be daunting. However, the consequences of neglecting website security can be far more severe. Leveraging tools like automated update services, employing reputable security plugins, and perhaps most importantly, fostering a routine of regular site reviews and updates, can significantly mitigate the risks. In the digital age, proactive security practices are not just beneficial; they are essential for safeguarding your online assets and maintaining the trust of your customers.

This incident with the MapPress Maps for WordPress plugin is a potent reminder of the ever-present nature of cybersecurity threats and the imperative of staying vigilant in an ever-evolving digital landscape.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

MapPress Maps for WordPress Vulnerability- Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2023-7225 |WordPress Plugin Vulnerability Report FAQs

Leave a Comment