WP Manifestindependent plugin directory
manifest / editor / newosm

NewOSM WP RegistryHigh-severity findings · 1 findingOpen the reportC-

OpenStreetMap Gutenberg block for WordPress with location search, marker placement, and fullscreen support. Modern block editor integration with REST API and local asset loading.

by Your Name · github.com/latz/newosm

★ 0stars
7release downloads
≈10active sites
v1.0.1latest · 9mo ago

Install

Download NewOSM-v1.0.1.zip From the v1.0.1 release on GitHub, Jan 26, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/latz/newosm/releases/download/v1.0.1/NewOSM-v1.0.1.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/latz/newosm ↗

NewOSM - OpenStreetMap Block for WordPress

A WordPress Gutenberg block plugin that allows you to insert interactive OpenStreetMap maps into your posts and pages with location search and marker placement functionality.

Features

  • Interactive Maps: Display OpenStreetMap maps in your WordPress content
  • Location Search: Search for any location using the Nominatim geocoding API
  • Marker Placement: Click on the map to place a marker, or drag to reposition
  • Size Presets: Quick size options (Small, Medium, Large, Fullscreen) or custom dimensions
  • Custom Dimensions: Set custom width and height for maps
  • Save Defaults: Save your preferred settings as defaults for new maps
  • Settings Page: Configure default map size, zoom, and dimensions
  • Customizable: Adjust map height, width, zoom level, and marker labels
  • Responsive: Maps automatically adapt to different screen sizes
  • Easy to Use: Simple block interface integrated with WordPress Gutenberg editor

Installation

  1. Upload the NewOSM folder to /wp-content/plugins/
  2. Activate the plugin through the 'Plugins' menu in WordPress
  3. Add the "OpenStreetMap" block to any post or page

Development

Requirements

  • Node.js 14+ and npm
  • WordPress 6.1+
  • PHP 7.4+

Build Instructions

# Install dependencies
npm install

# Development build with watch mode
npm run start

# Production build
npm run build

# Run tests
npm test

# Run tests with coverage
npm test -- --coverage

Performance

This plugin is optimized for performance with:

  • ✅ Canvas rendering (2-3x faster than SVG)
  • ✅ React memoization (40-60% fewer re-renders)
  • ✅ Tile layer optimization (~30% fewer requests)
  • ✅ Debounced updates
  • ✅ Deferred script loading

Performance improvement: ~40-50% faster than v1.1.5

📚 Documentation:

Usage

Adding a Map

  1. Add the Block: In the WordPress editor, click the '+' button and search for "OpenStreetMap"
  2. Search for a Location: Use the search field in the block settings sidebar to find a location
  3. Place a Marker: Click anywhere on the map to place a marker
  4. Adjust Settings:
    • Size Preset: Choose from Small (300×200), Medium (100%×400), Large (100%×600), Fullscreen (100%×800), or Custom
    • Custom Width: Set custom width (e.g., 100%, 800px, 50vw) when using Custom preset
    • Custom Height: Control the display height (200-1200px) when using Custom preset
    • Zoom Level: Adjust map zoom (1-18)
    • Marker Label: Add custom text to the marker popup
  5. Save as Default: Click "Save Current Settings as Default" to use these settings for new maps
  6. Publish: Save or publish your post to display the map on the frontend

Configuring Defaults

  1. Go to Settings > NewOSM in WordPress admin
  2. Configure default settings:
    • Default Size Preset: Choose the default size preset for new maps
    • Default Height: Set default height in pixels (used with Custom preset)
    • Default Width: Set default width (e.g., 100%, 800px)
    • Default Zoom Level: Set default zoom level (1-18)
  3. Click Save Settings

New maps will automatically use these defaults when inserted.

Block Settings

Inspector Controls (Sidebar)

  • Search Location: Search for any address, city, or landmark
  • Size Preset: Quick size options (Small, Medium, Large, Fullscreen, Custom)
  • Map Width: Custom width (visible when Custom preset selected)
  • Map Height: Custom height (visible when Custom preset selected)
  • Zoom Level: Control how close the map zooms in
  • Save Current Settings as Default: Save current configuration as defaults
  • Marker Label: Custom text for the marker popup
  • Clear Marker: Remove the currently placed marker

Block Attributes

  • latitude: Map center latitude (default: 51.505)
  • longitude: Map center longitude (default: -0.09)
  • zoom: Zoom level 1-18 (default: 13)
  • markerLat: Marker latitude position
  • markerLon: Marker longitude position
  • markerLabel: Text displayed in marker popup
  • height: Map height in pixels (default: 400)
  • width: Map width (default: "100%")
  • sizePreset: Size preset selection (default: "medium")

Size Presets

  • Small: 300px × 200px
  • Medium: 100% × 400px (default)
  • Large: 100% × 600px
  • Fullscreen: 100% × 800px
  • Custom: User-defined width and height

Technical Details

  • Frontend: React + Leaflet + React-Leaflet
  • Build System: @wordpress/scripts (Webpack-based)
  • Map Tiles: OpenStreetMap
  • Geocoding: Nominatim API
  • License: GPL v2 or later

Credits

License

This plugin is licensed under GPL v2 or later.

Support

For bug reports and feature requests, please contact the plugin author.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.1 latest
Jan 26, 2026 9mo ago
NewOSM-v1.0.1.zip
2
v1.0.0
Jan 26, 2026 9mo ago
NewOSM.zip
5

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

NewOSM 1.0.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.0
Findings
1
Worst severity
high
Content hash
6a3c177e707eb0e4ef2cdcaa…

Findings

  • high Stored DOM XSS via markerLabel passed to Leaflet bindPopup

    xss_stored

    The static save() of block newopm/osm-map writes attributes.markerLabel into data-marker-label on a public .newopm-map-frontend div. initializeNewOpmMaps (bundled as viewScript) reads that attribute with getAttribute and, when marker coordinates are present, calls marker.bindPopup(markerLabel). Leaflet 1.9.4 Popup._updateContent assigns string content with innerHTML, so event-handler HTML such as <img src=x onerror=alert(document.domain)> executes when a visitor (or an administrator previewing a pending Contributor post) opens the marker popup. A <script> tag via innerHTML would not run; these payloads use event handlers, which do. markerLabel is a raw block string (block.json type string, no sanitize) set from the editor TextControl or from Nominatim display_name. wp_kses_post does not strip HTML that lives in a data-* attribute value, so Author (publish_posts, no unfiltered_html) and Contributor (edit_posts, pending review) bypass kses. The editor Popup path in edit.js interpolates label as React text (safe); only the frontend bindPopup sink is unsafe. Observable consequence: JS in the origin of anyone who views the published/previewed post and clicks the marker, including admin-session theft. viewScript points at the same index.js as editorScript, so the public page also enqueues wp-api-fetch; core then inlines wp.apiFetch.createNonceMiddleware(wp_rest nonce), which the payload can reuse.

    src/save.js:12-21, 94-116

    Recommendation

    Treat markerLabel as untrusted text. Escape HTML entities (or use a text node / DOM APIs) before bindPopup, or pass a DocumentFragment instead of a string so Leaflet does not innerHTML the label. Do not use Leaflet html/divIcon for this field. Split viewScript from the editor bundle so the frontend does not enqueue wp-api-fetch/wp-block-editor. Optionally add a block attribute sanitize callback that runs wp_kses or sanitize_text_field on markerLabel.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →