WordPress security by component
MapSVG
Plugin description
MapSVG is a WordPress component with 10 published CVE records in this archive. The latest tracked vulnerability was published Jul 23, 2026; the highest CVE/CNA score is 9.9.
Plugin slug:
mapsvg-lite-interactive-vector-mapsLatest vulnerability
CVE-2026-65455: MapSVG: Dangerous file upload
MapSVG is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The published affected range is n/a through 8.14.0.
| Safe version |
|
||
|---|---|---|---|
| Jul 23, 2026 |
CVE-2026-65455
MapSVG: Dangerous file upload
MapSVG is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The published affected range is n/a through 8.14.0.
|
8.14.1 |
CVE9.1
NVDPending
|
| Jul 23, 2026 |
CVE-2026-65450
MapSVG: SQL injection
MapSVG is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 8.14.0.
|
8.14.1 |
CVE8.5
NVDPending
|
| Jul 23, 2026 |
CVE-2026-65449
MapSVG: Cross-site scripting
MapSVG is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 8.14.0.
|
8.14.1 |
CVE6.5
NVDPending
|
| Jul 21, 2026 |
CVE-2026-1771
MapSVG – Vector maps, Image maps, Google Maps: Dangerous file upload
MapSVG – Vector maps, Image maps, Google Maps is affected by dangerous file upload. Exploitation requires at least administrator-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The published affected range is <= 8.14.0.
|
> 8.14.0 |
CVE7.2
NVDPending
|
| Dec 29, 2025 |
CVE-2025-68562
MapSVG: Dangerous file upload
MapSVG is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE9.9
NVDPending
|
| Oct 27, 2025 |
CVE-2025-62930
MapSVG: Cross-site scripting
MapSVG is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| May 16, 2025 |
CVE-2025-48120
MapSVG: Code execution
MapSVG is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Apr 17, 2025 |
CVE-2025-32682
MapSVG: Dangerous file upload
MapSVG is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE9.9
NVDPending
|
| Apr 09, 2025 |
CVE-2025-32684
MapSVG: A security weakness
MapSVG is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.0
NVDPending
|
| Apr 09, 2025 |
CVE-2025-32683
MapSVG: Cross-site scripting
MapSVG is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|