CVE-2025-54748

The MapSVG plugin contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 8.16.1.

The MapSVG plugin (mapsvg-lite-interactive-vector-maps) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects versions from n/a through 8.16.1.

The MapSVG plugin contains a Missing Authorization vulnerability that allows retrieval of embedded sensitive data. This issue affects versions from n/a through 8.16.1.

The MapSVG plugin (interactive vector maps for WordPress) through 8.16.1 allows unrestricted upload of files with dangerous types. This enables an attacker to upload and execute a web shell on the web server.

The MapSVG plugin version 8.14.0 and earlier contains an SQL injection vulnerability exploitable by an unauthenticated attacker.

MapSVG versions up to 8.14.0 contain an Administrator Arbitrary File Upload vulnerability. An administrator can upload a malicious file, potentially leading to remote code execution on the server.

The MapSVG plugin versions up to 8.14.0 are vulnerable to unauthenticated SQL injection.

The MapSVG plugin for WordPress (versions up to 8.16.1) contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. This may allow an attacker to access files outside the intended directory.

MapSVG versions up to 8.15.0 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can make the server send requests to arbitrary resources, including internal ones, without authentication.

The MapSVG plugin for WordPress up to version 8.14.0 is vulnerable to stored XSS via user-supplied attributes in map options. Insufficient sanitization and escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute on every visit to the injected page.