WP Manifestindependent plugin directory

Install

Download cmb2-mapbox.zip From the v2.0.0-beta1 release on GitHub, May 18, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/pixelwatt/cmb2-mapbox/releases/download/v2.0.0-beta1/cmb2-mapbox.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

CMB2 Mapbox Banner

This plugin adds a new CMB2 fieldtype for adding a single point to a Mapbox map. This plugin requires CMB2 and a Mapbox access token.

The field.

Description

This is the initial release of a plugin that extends CMB2 by adding a new fieldtype called "mapbox_map", which allows content editors to add a single point to a map.

Location data for the chosen location is saved as an array under the meta key of your choice:

Array
(
    [lat] => 34.72724208492225
    [lng] => -86.58798437717418
    [lnglat] => -86.58798437717418,34.72724208492225
)

To add a maxbox_map field:

$cmb2->add_field(
    array(
        'name'     => __( 'Map Location', 'mtsi' ),
        'desc'     => __( 'Drop a pin for this location.', 'mtsi' ),
        'id'   => '_my_meta_key',
        'type'     => 'mapbox_map',
    )
);

Optionally, you can set the default zoom for the map (used when loaded with no previously-set location):

$cmb2->add_field(
    array(
        'name'     => __( 'Map Location', 'mtsi' ),
        'desc'     => __( 'Drop a pin for this location.', 'mtsi' ),
        'id'   => '_my_meta_key',
        'type'     => 'mapbox_map',
        'default_zoom' => 3,
    )
);

A PHP class, CMB2_MB_Map, has also been provided for building maps with pins from multiple posts. Documentation coming shortly.

Installation

  1. Upload the cmb2-mapbox folder to the /wp-content/plugins/ directory
  2. Activate the plugin through the 'Plugins' menu in WordPress
  3. Provide your Mapbox access token and optionally set the default map center by going to Settings > CMB2 Mapbox
  4. Add a mapbox_map field to a CMB2 metabox.
  5. Profit.

Releases

7 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.0.0-beta1 latest
May 18, 2026 5mo ago
cmb2-mapbox.zip
5
Apr 4, 2024 2 years ago
tag only
—
Jul 9, 2023 3 years ago
tag only
—
Mar 30, 2023 3 years ago
tag only
—
Mar 9, 2021 5 years ago
tag only
—
Mar 8, 2021 5 years ago
tag only
—
Dec 2, 2020 5 years ago
tag only
—
B grade

Security

CMB2 Mapbox 2.0.0-beta1 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
2.0.0-beta1
Findings
2
Worst severity
medium
Content hash
365dd8eddd81c08a6ec34bcf…

Findings

  • medium Unescaped Mapbox token and coordinates interpolated into inline JavaScript

    missing_escaping

    cmb2_render_mapbox_map_callback echoes mapbox_api_token, saved lnglat, and mapbox_map_center directly into a <script> block without esc_js/json_encode. A crafted token or coordinate string stored via the CMB2 options page or field meta can break out of the JS string and execute in the admin (or any screen rendering the field).

    cmb2-mapbox.php:128-140

    Recommendation

    Output token and numeric coords with esc_js() or preferably wp_json_encode() into JS variables; validate lng/lat as floats before echo.

  • low Mapbox GL scripts enqueued on every frontend request

    unnecessary_attack_surface

    cmb2_mapbox_scripts is hooked to wp_enqueue_scripts unconditionally, loading Mapbox GL CSS/JS site-wide even when no map field is rendered, expanding third-party script attack surface.

    cmb2-mapbox.php:102-112

    Recommendation

    Enqueue Mapbox assets only when a mapbox_map field is present (admin field render or front template that needs it).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.