CVE-2025-62930
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The MapSVG plugin for WordPress (versions up to 8.7.22) is vulnerable to DOM-Based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability arises from insufficient encoding of user-supplied data, allowing execution of malicious scripts in the victim's browser.
Risk Assessment
An attacker can inject malicious JavaScript that executes in the user's browser context, potentially leading to session theft, redirections, or content modification. The risk affects all sites with the vulnerable plugin version installed.
Recommendation
Update the MapSVG plugin to the latest version (above 8.7.22) or remove it if not used. Additionally, consider implementing security headers such as Content-Security-Policy to mitigate the impact of potential XSS attacks.
Other vulnerabilities in MapSVG
See all- CVE-2026-111405Medium
The MapSVG plugin contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 8.16.1.
- CVE-2026-111399High
The MapSVG plugin (mapsvg-lite-interactive-vector-maps) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects versions from n/a through 8.16.1.
- CVE-2026-111397Medium
The MapSVG plugin contains a Missing Authorization vulnerability that allows retrieval of embedded sensitive data. This issue affects versions from n/a through 8.16.1.
- CVE-2026-111406Critical
The MapSVG plugin (interactive vector maps for WordPress) through 8.16.1 allows unrestricted upload of files with dangerous types. This enables an attacker to upload and execute a web shell on the web server.
- CVE-2026-59527Critical
The MapSVG plugin version 8.14.0 and earlier contains an SQL injection vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-65455Critical
MapSVG versions up to 8.14.0 contain an Administrator Arbitrary File Upload vulnerability. An administrator can upload a malicious file, potentially leading to remote code execution on the server.
- CVE-2026-59526Critical
The MapSVG plugin versions up to 8.14.0 are vulnerable to unauthenticated SQL injection.
- CVE-2026-111398High
The MapSVG plugin for WordPress (versions up to 8.16.1) contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. This may allow an attacker to access files outside the intended directory.
- CVE-2026-82852Medium
MapSVG versions up to 8.15.0 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can make the server send requests to arbitrary resources, including internal ones, without authentication.
- CVE-2025-9205Medium
The MapSVG plugin for WordPress up to version 8.14.0 is vulnerable to stored XSS via user-supplied attributes in map options. Insufficient sanitization and escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute on every visit to the injected page.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows DOM-Based XSS.This issue affects MapSVG: from n/a through <= 8.7.22.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS