Skip to content
PluginCanary

Extensions for Leaflet Map

by hupe13 · 3,000+ active installs · Checked 3 Nov 2026
Avoid1 Critical1 Warning

Avoid: vulnerability published 22 Oct 2026 with no patched version yet.

39/ 100 Canary Score

Capped at 39 while a vulnerability has no patch.

Sub-scores for Extensions for Leaflet Map
Ownership100
Maintenance100
Security5
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • CriticalSEC-1Vulnerability published 22 Oct 2026 with no patched version yet. Disable or replace the plugin until a fix is released.22 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 28 Oct 2026, fixed in 6.0. Update to version 6.0 or later.28 Oct 2026Evidence
  • InfoSEC-36 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master22 Mar 2021 to 22 Mar 2021, 1 commits
hupe1323 Mar 2021 to 2 Nov 2026, 667 commits

2 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
18 days ago
Releases, 24 months
25
Tested up to
7.1 current
Requires PHP
8.2 supported 8.2+
Releases per quarter for Extensions for Leaflet Map
Q1 20245
Q2 20247
Q3 20244
Q4 20244
Q1 20252
Q2 20253
Q3 20251
Q4 20253
Q1 20266
Q2 20265
Q3 20261
Q4 20261

Last release 17 Oct 2026. Tested with WordPress 7.1 (current).

Support

0% of 2 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
28 Oct 2026Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property5.4<= 5.46.00
22 Oct 2026Extensions for Leaflet Map <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 6.0No fixn/a
7 Jul 2026Extensions for Leaflet Map <= 5.1 - Unauthenticated Stored Cross-Site Scripting7.2<= 5.15.20
2 Apr 2026Extensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode6.4<= 4.144.156
23 Nov 2025Extensions for Leaflet Map <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.84.90
3 Nov 2025Extensions for Leaflet Map <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.74.80
24 Apr 2023Extensions for Leaflet Map <= 3.4.1 - Reflected Cross-Site Scripting6.1<= 3.4.13.4.20

Source: Wordfence Intelligence.

Reputation

Lifetime rating 5.0 from 24 ratings. Quarterly trends appear as new reviews arrive.

Rating distribution
5 star24
4 star0
3 star0
2 star0
1 star0

Momentum

3,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Extensions for Leaflet Map
4 May 2026200
11 May 2026236
18 May 2026273
25 May 20261,099
1 Jun 2026485
8 Jun 20261,366
15 Jun 2026859
22 Jun 2026759
29 Jun 2026209
6 Jul 2026375
13 Jul 2026199
20 Jul 2026182
27 Jul 2026162
3 Aug 2026157
10 Aug 20261,547
17 Aug 2026312
24 Aug 2026214
31 Aug 2026209
7 Sep 2026169
14 Sep 2026161
21 Sep 2026189
28 Sep 2026173
5 Oct 2026175
12 Oct 20261,385
19 Oct 2026785
26 Oct 2026747
2 Nov 202671

Weekly downloads over the last 4 weeks are 59% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

API KEY for Google MapsScore 91 · 30,000+Maps Widget for Google MapsScore 91 · 20,000+Map BlockScore 91 · 6,000+HTML5 MapsScore 91 · 4,000+exovia GDPR Google MapsScore 91 · 4,000+

Facts

Version6.0
Authorhupe13
Added23 Mar 2021
Last updated17 Oct 2026
Active installs3,000+
Requires WordPress6.8
Tested up to7.1.4
Requires PHP8.2
CategoryE-commerce & Shopping
TagsGPX, hover, marker, geojson, leaflet

Other plugins by this author: DSGVO snippet for Leaflet Map and its Extensions, Album of photos from a folder in the Media Library, Block old browser versions and suspicious browsers

Questions

Is Extensions for Leaflet Map still maintained?

Extensions for Leaflet Map was last updated on 17 Oct 2026. Its Canary status is Avoid.

Is Extensions for Leaflet Map safe?

Extensions for Leaflet Map has 1 published vulnerability with no patched version. Its Canary status is Avoid.

Who owns Extensions for Leaflet Map?

The wordpress.org author is hupe13. Recent committers: hupe13, plugin-master. We have recorded no ownership change.

What can I use instead of Extensions for Leaflet Map?

Plugins in the same category with a higher Canary Score: API KEY for Google Maps, Maps Widget for Google Maps, Map Block, HTML5 Maps, exovia GDPR Google Maps.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue