WordPress security changelog
HIGH CVE-2026-1771 Deferred

MapSVG – Vector maps, Image maps, Google Maps: Dangerous file upload

MapSVG – Vector maps, Image maps, Google Maps is affected by dangerous file upload. Exploitation requires at least administrator-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The published affected range is <= 8.14.0.

CVE / CNA score 7.2 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
MapSVG – Vector maps, Image maps, Google Maps
Plugin slug
mapsvg-lite-interactive-vector-maps
Affected
<= 8.14.0
Safe version
> 8.14.0
Published
Jul 21, 2026
Weakness
CWE-20 — Improper Input Validation

This CVE was published Jul 21, 2026 and is one of 10 known issues for this plugin.

What to do

Patch or disable the affected component.

Update MapSVG – Vector maps, Image maps, Google Maps to a release after 8.14.0, or disable and remove it until a fixed version is available.

Source record

Technical description

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources