Hi everyone,

thank you for using WP GPX Maps, and sorry for the long silence over the past months. Version 1.8.00 is a maintenance and security release. This topic lists what it fixes, what is still open, and what comes next. I will keep it updated.

FIXED IN 1.8.00
If you opened a topic about one of these, please update to 1.8.00 and let us know if the problem is solved.

• Security: fixed a reflected XSS. Shortcode parameters can no longer be set from the page URL. Also fixed path traversal on the gpx attribute and added CSRF protection on GPX upload. Please update.
• Blank map: the map did not appear on sites with nested permalinks (e.g. /2026/10/my-post/) or with WordPress in a subfolder.
• Map not shown with waypoints enabled.
• PHP 8.x errors (“critical error” after updating, maps not showing on PHP 8.1–8.4): missing or broken GPX files, tracks without time or elevation, empty heart rate/cadence values, remote GPX that can’t be downloaded.
• Chart errors with GPX files that contain more than one track, or when the altitude chart is disabled.
• Heart rate, cadence and temperature are now read from Strava and other apps, not only Garmin.
• Uploads by Editors and Authors are saved in their own folder again.
• Custom waypoint icon now works. Total time is correct for tracks longer than 24 hours.
• Browser cache: browsers now load the new JavaScript after each update.

Requirements: WordPress 6.5+ and PHP 7.4+. Tested up to WordPress 7.1.

CHANGES THAT MAY AFFECT YOUR SITE

• Parameters in the page URL (e.g. ?showele=false) are no longer read. Set them in the shortcode or in Settings → WP GPX Maps.
• GPX files must be inside your WordPress folder (e.g. /wp-content/uploads/gpx/…). Remote URLs (https://…) still work.
• MapBox maps now use the API key you enter in the settings.

KNOWN ISSUES (NOT FIXED YET)

• With multiple tracks in one GPX file, the distance in the chart restarts from 0 for each track, so the lines overlap.
• “Total descent” in the summary is shown as a negative number.
• A corrupted GPX file shows an empty map without an error message.
• Hike & Bike, OpenCycleMap and other Thunderforest layers need your own Thunderforest API key.

ROADMAP
Without dates: this is a side project, and priorities may change based on your feedback.

1.8.x – bug fixes

• The known issues above
• More automated tests (every change is now checked on PHP 7.4–8.4 before release)

1.9 – easier to use, faster pages

• Gutenberg block with live preview and settings in the sidebar (the [sgpx] shortcode stays)
• Scripts loaded only on pages that contain a map, and the map loads only when it is visible
• Different colors for multiple tracks; track colored by slope or speed
• Satellite layer

2.0 – more formats and maps

• Import FIT, TCX and KML files, not only GPX
• More map providers (MapTiler, Stadia, national topographic maps)
• Optional local tile cache/proxy for privacy (GDPR)
• Accessibility improvements

HOW TO REPORT A PROBLEM
Please open a new topic (not a reply here) and include:

1. WordPress and PHP version, and WP GPX Maps version
2. The shortcode you use
3. A link to the page, or the GPX file (you can share it through a link)
4. Any error in the browser console (F12 → Console) or in wp-content/debug.log

Development happens on GitHub: https://github.com/devfarm-it/wp-gpx-maps. Pull requests are welcome, and thanks to everyone who already contributed!

Massimo