WP Manifestindependent plugin directory
manifest / content / post-map-table-view

Post Map Table View WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Displays WordPress posts or pages with GPS (lat/lon) data from custom fields on an OpenStreetMap using Leaflet. Supports category-based filtering, custom markers, and an optional table view. Can also render maps from external JSON data sources.

★ 3stars
11release downloads
1.5.1latest · 4mo ago

Install

Download PostMapTableView.zip From the 1.5.1 release on GitHub, Jun 12, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/martinvonberg/post-map-table-view/releases/download/1.5.1/PostMapTableView.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

This WordPress plugin displays posts or pages with GPS coordinates (latitude/longitude stored in custom fields) on an interactive OpenStreetMap using Leaflet.

Posts can be organized and filtered by Tags and categories and visualized with custom markers. In addition to the map, an optional table view lists all displayed entries.

As an alternative to WordPress-based content, the plugin also supports external JSON data sources. This allows you to create maps for travel routes, destinations, or any custom points of interest (POIs) independent of posts or pages.

The plugin is configuration-driven and does not provide an admin interface. All settings are defined via shortcodes or JSON files.

Features

  • Display posts or pages with GPS coordinates on a map
  • Tag and Category-based filtering and custom marker icons
  • Optional table view of all entries
  • Support for external JSON-based data sources
  • Local storage of map tiles (optional)
  • Performance optimization via transients

Usage

Shortcode: [mapview]

Displays a map with posts or pages containing GPS coordinates.
Multiple configuration options are available (see below).
Note: Use this shortcode only once per page or post.

Shortcode: [tourmap tourfolder=<folder>]

Displays a map based on a JSON file located in a folder relative to the WordPress upload directory.

This mode is intended for advanced users who manage data manually via JSON files (e.g. using FTP tools like FileZilla).

Note: This shortcode should also be used only once per page or post.

Contents

Demo

Example of the plugin in action: Demo

Detailed Usage of [mapview]

1. Prepare Posts / Pages for the Post-Map shown by [mapview]

Add Custom Fields

  • Lat: Latitude (use a decimal point as separator)
  • Lon: Longitude (use a decimal point as separator)
    • Posts with (0,0), invalid, or missing custom fields lat, lon are ignored.
    • To check if the custom fields are set, use the "Admin Columns" WP plugin for better overview.
  • Hint: By using the shortcode [mapview] the retrieved geoadress will be stored as additional custom field to the post or page.

GPX-Tracks

Define Categories or Tags

The Posts are sorted by a combination of WordPress-Categories and Tags. If no Tags are defined the WP-category will be used. If both are not defined the default will be used. So, define some WordPress Categories (see Table below) and change the /<Plugin-Folder>/settings/category_mapping.json accordingly. (The combination of Tags and Categories is furtheron shortened by 'Category')

2. Check Category/Tag and Icon Mapping

Categories are now defined in a JSON file in /<Plugin-Folder>/settings/category_mapping.json. So it is fully customizable by changing this file. The Icon-PNGs are expected in /<Plugin-Folder>/images/ Below is the default (german) mapping (which might be changed easily in the settings-file):

Category Icon Note
Reisebericht travel.png DEFAULT if no category is defined.
Campingplatz campingground.png
Stellplatz campingcar.png
Besichtigung sightseeing.png
Trekking hiking.png
Bike-Hike mountainbiking-3.png
Radfahren cycling.png
Mountainbike MTB.png
Wanderung hiking2.png
Bergtour peak2.png
Skitour skiing.png
Paddeln kayaking2.png

It is case sensitive! Simple translate or change according to the defined categories of your site, e.g. translate Category 'Radfahren' to 'Cycling' or 'Skitouren' to 'SkiMo' or so.

2. Displaying the Map

Insert the [mapview] shortcode on any page. Use only once per Page or Post!. All below defined Parameters are optional, so not mandatory.

Detailed Usage of [tourmap]

1. Generate JSON-File(s) locally (Required!)

HINT: If no JSON-File is provided nothing will be shown.

If you used MapsMarkerPro before:

  • Download the geojson File(s) for the Map. Add at least a 'category' according to the 'category' in file ./settings/category_mapping.json. Alternatively you might change the file category_mapping.json to your tourfolder. If available, this 'local' file will be used for the tourmap.

Write your geojson-File from the scratch. The geojson for ONE Point is like so:

{
    "type": "FeatureCollection",
    "features": [
        {
            "type": "Feature",
            "geometry": {
                "type": "Point",
                "coordinates": [
                    16.7,
                    39.9
                ]
            },
            "properties": {
                "id": "1",
                "name": "Campingplatz im Nationalpark Pollino",
                "text": "Einen Campingplatz im Nationalpark Pollino haben wir nicht gefunden. Das ist schade. Einen Campingplatz im Nationalpark Pollino haben wir nicht gefunden. Das ist schade.",
                "link": "https://www.berg-reise-foto.de/tourenbericht-wanderung/wandern-im-nationalpark-pollino",
                "category": "Stellplatz",
                "image": "https://www.berg-reise-foto.de/smrtzl/uploads/Alben_Website/Wanderung-Gole-del-Raganello/Italien_2018_12-1013-200x150.jpg"
            }
        }
    ]
}

I recommend to use geojson.io to generate the structure of the geojson especially define the coordinates with an interactive map. The required fields in the properties section might be added in the table and content added manually. Additionally you might change the file category_mapping.json to your tourfolder. If available, this 'local' file will be used for the tourmap.

2. Optional: Prepare one GPX-File

Download from your Track-Cloud / Provider and reduce to the usefull size and content.

3. Upload Files to your WordPress-Site

The upload has to be done 'manually' by FileZilla or any comparable tool. Is you prepare the Files locally you will have a backup automatically.

I recommend to download the file ./settings/category_mapping.json from the Plugin-Folder if you intend any changes in future. This file will be overwritten with every plugin update. Same procedure for .htaccessin .\leaflet_map_tiles.

4. Add shortcode to page

Use it like so [tourmap tourfolder=<folder relative to upload directory with json-file>]. Use only once per Page or Post! For other parameters see table below.

5. Screenshot / Demo

Live-Demo on my Site: https://www.berg-reise-foto.de/reisebericht-italien/uebersicht-wohnmobilreise-sueditalien-winter-2022/

tourmap_example

Shortcode Parameters [mapview] and [tourmap]

The following parameters are available for both shortcodes (where not all will be used by tourmap). | Parameter | Default Value | Description | Example | |-----------|---------------|-------------|---------| | numberposts | 100 | Number of posts to display (maximum : 1000) | - | | post_type | post | Post types (can be an array) | post,page | showmap | true | Show the map | | showtable | true | Show the table | | tablefirst | false | Show the table above the map | | category | all | Filter by category-slug NOT Name! (case-sensitive, includes child categories) | travel,biking | headerhtml | "" | Custom HTML for table header. Mind restrictions of passing html in shortcode parameters | <h3>Tour Table</h3> | gpxfolder | gpx | Folder containing GPX files | gpx | lenexcerpt | 150 | Length of the excerpt | | usewpexcerpt | false | Use WordPress excerpt | | titlelength | 80 | Max title length | | usetileserver | true | Use tile server | | converttiles | true | Convert tiles to *.webp | | contentfilter | "Kurzbeschreibung:, Tourenbeschreibung:" | Content filter keywords which are removed from the excerpt | | tabulatortheme | tabulator.min.css | Tabulator.js theme from folder ./css. Available are: bootstrap3, bootstrap4, bootstrap5, bulma, materialize, midnight, modern, semanticui, simple, site_dark, site, custom in tabulator_custom.min.css (change this according to your needs) | | tablepagesize | 20 | Number of rows per table page | | tableheight | 0 | Height of the table. 0 is ignored. Used to improve Table load time | | mapheight | "" | Map height in valid CSS units | 800px | | mapwidth | "" | Map width in valid CSS units | 600px | | mapaspectratio | "" | Map aspect ratio as valid CSS | 3/2 | |-|-|-|-| | tourfolder | tourfolder=tourmap/Italy-2022 | The folder with JSON-Files relative to the WordPress-Uploads-Folder. Used by shortcode [tourmap] only | | | trackcolour| #ff0000 | The colour of the gpx-track on the map, if any| red | | trackwidth | 3 | The width in px of the gpx-track on the map, if any| 3px | | mapselector | OpenStreeMap | The preselected Map | - | | mymarkericons | false | Use another styling for the marker icons if true | - | | Use the following with [mapview] only |||| | hidetitle | false | Hide the column with field name 'title'. Mind that the translated name is different! | | hidecategory | false | Hide the column with field name 'category'. Mind that the translated name is different! | | hidedistance | false | Hide the column with field name 'distance'. Mind that the translated name is different! | | hideascent | false | Hide the column with field name 'ascent'. Mind that the translated name is different! | | hidedescent | false | Hide the column with field name 'descent'. Mind that the translated name is different! | | hidecountry | false | Hide the column with field name 'country'. Mind that the translated name is different! | | hidestate | false | Hide the column with field name 'state'. Mind that the translated name is different! | | hidecity | false | Hide the column with field name 'city'. Mind that the translated name is different! | | Use the following only together, even if columns are hidden |||| | cf_distance | '' | Name of the Custom Field for GPX-Track Distance that is used in Post / Page | | cf_ascent | '' | same for Ascent | | cf_descent | '' | same for Descent |

Check Tile Server Settings in .htaccess

Used by both shortcodes.

Tile Server for Leaflet Map Tiles

Since version 1.0.0, it is also possible to cache the leaflet tiles locally on your own server. This procedure conforms to the guidelines of the osmfoundation (https://operations.osmfoundation.org/policies/tiles/). There is no bulk download and the maps are stored locally. The Http referrer of the current request is used as the Http referrer. In addition the visitor's IP is NOT forwarded to the map server. This ensures that the use of maps from OpenStreeMap complies with the General Data Protection Regulation EC 2016/679. Therefore, no notice is required in the privacy policy of the website. This option can be set via shortcode parameter. Furthermore, the conversion of the tiles into webp file format can be chosen in order to meet Google Pagespeed requirements. **Note:*** The file ./the-plugin-folder/leaflet_map_tiles/.htacces has to be changed for the correct path and stored locally. Currently it will be overwritten with every Plugin-Update. So restore it manually afterwards.

    ... content of .htaccess in ../the-plugin-folder/leaflet_map_tiles
    # Change only the next according to your server 
    RewriteBase /wordpress/wp-content/plugins/the-plugin-folder/leaflet_map_tiles/
    # Do not change after this line

Drawback: No fileage clean-up implemented. So, once stored, the tiles are used forever. Currently, only a manual deletion works which forces a new download of the tiles.

Upgrade Notice

No need to upgrade right now. Update, if your GPX-files are not parsed correctly. ATTENTION Your changes in category_mapping.json will be overwritten! Safe this file and .htaccess locally prior to updating.

I18N

Status with wp solution: npm make-pot and wp i18n make-pot do not pass translation comments and flags to the pot- and po- files. Mo files are binary reduced to the minimum, so no comments included by definition. Tested workflow: Generate the pot with eazy po and translate the pot with poedit. Generate the mo files with poedit. But: there is no WP built in function to load comments and flags into php or js. So, this had to be written by me. Finally the frontend is translated in the client for tabulator and leaflet where the translations are hardcoded in js. The PHP error messages are translated in PHP by the WP standard way.

Installation

  1. Download the Release. Do not use the zip of the repository. This won't work (due to webpack transpilation).
  2. Install via the standard WP method (Upload zip in Admin Dashboard).
    • If already installed, remove the old version first! No additional directories or database entries will be deleted.
  3. Activate the plugin through the "Plugins" menu in WordPress.
  4. Done! No further settings required.

Deinstallation

  • Use the standard method of WordPress.

Changelog

1.5.1 (13.08.2026)

  • Close github security issues.
  • test with WP 7.1.

1.5.1 (12.06.2026)

  • update "get_statistics_from_gpxfile" including Unit-Tests. Extend PHPUnit-Tests for that and for XSS-Attacks.
  • test with WP 7.0.

1.5.0 (31.03.2026)

  • add shortcode parameters to get gpx-statistics distance, ascent, distance from WP custom fields.

1.4.0 (31.03.2026)

  • add parameters to change order of table and map and to hide table columns.
  • update treatment of gpxfiles in PHP
  • Fix .htaccess generation for tileserver
  • fixes due to usage of PHPStan (level 8) and eslint
  • update leaflet.fullscreen to V5.3.1

1.3.3 (28.03.2026)

  • Update Unit Tests, Minor PHP Bug Fixes. Update PHP-Header for Plugin main file.
  • Tested with WP 6.9.4, locally.
  • Updated all JS libs used on site (excluded save-dev). W.r.t composer, no updates required for site packages.

1.3.2 (03.12.2025)

  • Tested with WP 6.9.0, locally.

1.3.2 (08.09.2025)

  • Updated .htaccess for Apache-servers > 2.3 in src and release
  • Tested with WP 6.8.2, locally.

1.3.1 (15.05.2025)

  • Tested with WP 6.8. No changes for that.
  • introduced ESlint. Non functional changes for that.

1.3.0 (07.03.2025)

Google Maps links removed to avoid DSVGO problems. Replace by a link to HERE-we-go which is hosted in Europe.

1.2.0 (01.03.2025)

Translation process updated, see I18N chapter herein. Automatic generation of .htaccess file added.

1.1.0 (26.02.2025)

Translation for en, it, es, fr included. Translation for Tabulator.js is done in the frontend (for leaflet it what so before). Prerequisite: The html content has to be in English. Therefore the language in PHP is set to en_US. Further translations have to be added in JS-code and not in po-, mo-files.

1.0.1 (16.02.2025)

  • CSS-File Clean-up: small main css is loaded in PHP. Reason for red clusters removed. grid prepared but not used.

1.0.0 (14.02.2025)

  • TBD, see github changelog.

0.10.5 (14.05.2022)

  • Tested with WordPress 6.0

0.10.4 (02.02.2022)

  • Minor PHP warning correction to satisfy PHPStan (level 5) and QueryMonitor

0.10.3 (30.01.2022)

  • Replaced Bike-Hike-Map with CycleOSM

0.10.2 (16.01.2022)

  • Minor PHP bugfix

0.10.1 (13.01.2022)

  • CSS changes for new theme
  • Readme update

0.10.0 (30.11.2021)

  • Switched to tabulator.info

0.9.1 (18.11.2021)

  • Introduced and tested transients for PHP -> JS variable $postArray

0.9.0 (16.11.2021)

  • Reworked flexible icons and groups provided by PHP script
  • Tours are now passed to JS as a variable

0.8.1 (08.11.2021)

  • Added 'tab: false' for Safari to open pop-ups correctly

0.8.0 (30.03.2021)

  • Added a table to show all posts under the map
  • Bootstrap-table used for rendering
  • Full functionality not guaranteed with the "Photo Perfect Pro" theme
  • Fixed leaflet loading issue (ensuring it loads only once)
  • All files now loaded locally
  • Passed variable g_wp_postmap_path to JS using localize_scripts
  • Introduced transients to store the generated HTML output (re-generated if a new post is published)

0.7.0 (17.02.2021)

  • PHP 8 compatibility check (OK, no changes needed)
  • Replaced jQuery with $
  • Run JS only if div 'map10_img' is present

0.6.0 (09.01.2021)

  • Mobile improvement: Hide zoom controls on mobile devices

0.5.0 (28.12.2020)

  • Speed improvement: Optimized excerpt function (uses <p> abstracts only)
  • Replaced function for converting tags to strings with an anonymous function

0.4.0 (14.12.2020)

  • Introduced namespace

0.3.0 (01.04.2020)

  • Initial release

Credits

This plugin utilizes the following libraries and resources:

Releases

6 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.5.1 latest
Jun 12, 2026 4mo ago
PostMapTableView.zip
4
Mar 31, 2026 6mo ago
PostMapTableView.zip
1
Mar 31, 2026 6mo ago
PostMapTableView.zip
1
Dec 3, 2025 10mo ago
PostMapTableView.zip
2
Mar 1, 2025 1 year ago
PostMapTableView.zip
1
Feb 26, 2025 1 year ago
postmaptableview.zip
2
B grade

Security

Post Map Table View 1.5.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.5.1
Findings
1
Worst severity
medium
Content hash
6f18a2b9357be3155e9a2ede…

Findings

  • medium Unauthenticated tile proxy writes unbounded cache files under the plugin directory

    dos

    leaflet_map_tiles/tileserver.php is a standalone script (no WordPress bootstrap, no capability or nonce). Any unauthenticated GET with tile=osm|otm|cycle|sat/{z}/{x}/{y}.{png|jpg|jpeg|webp} is accepted when z/x/y are ctype_digit (no zoom 0–19 cap, no numeric range check, no rate limit, no Referer/origin check). The script mkdir()s 0777 paths under the plugin folder and file_get_contents()s a hardcoded public tile host (tile.openstreetmap.org, a.tile.opentopomap.org, a.tile-cyclosm.openstreetmap.fr, or server.arcgisonline.com), then file_put_contents the image (optionally converting to webp). Direct ?tile= access works even when .htaccess rewrite is absent and even when the [mapview] usetileserver parameter is false, so merely installing the plugin exposes an open cache that an attacker can bulk-fill to exhaust disk/inodes and bandwidth. Destinations are allowlisted CDNs (not internal/metadata SSRF) and extensions are image-only, so this is availability/abuse rather than RCE.

    leaflet_map_tiles/tileserver.php:39-173

    Recommendation

    Gate the endpoint (shared secret, signed URLs, or at least same-origin Referer plus a tight rate limit). Reject zoom/x/y outside the valid range for that z (typically z<=19 and x,y < 2^z). Cap cache size and use 0755 for new directories. Do not ship a callable PHP file that fetches and writes on every missing tile without authentication; consider serving tiles only through WordPress with a capability-free but quota-limited handler, or disable the script unless the local tile cache is explicitly enabled.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.