Executive brief
The MapSVG plugin for WordPress, which is used to create interactive vector and Google maps, contains a security flaw that allows certain logged-in users to inject malicious scripts into website pages. An attacker with contributor-level access or higher could use this to run unauthorized code in the browsers of other visitors or administrators. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the map options attributes in versions up to 8.14.0. The root cause is a failure to properly sanitize user-supplied input and escape output within the plugin's administrative interface. An authenticated attacker with contributor-level permissions or higher can inject arbitrary JavaScript into the database. This script then executes in the context of any user's browser who views the affected page, potentially allowing for session hijacking or unauthorized administrative actions. A patch has been released to address this by improving input validation and output encoding.
Affected products
- oyatek MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0
Timeline
- 2026-07-24: disclosed
- 2026-07-24: advisory
References
- https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/tags/8.7.5/php/Admin/Admin.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3608308%40mapsvg-lite-interactive-vector-maps&new=3608308%40mapsvg-lite-interactive-vector-maps
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a2dab9d3-a890-4c66-a825-e30329e37a60?source=cve