plugin
18 known security issues reported for the Mapsvg Lite Interactive Vector Maps WordPress plugin. Most recent disclosed Jul 23, 2026.
Running Mapsvg Lite Interactive Vector Maps on your site? Check whether your installed version is affected.
Scan your site freeThe MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, with contributor-level acc...
The MapSVG – Vector maps, Image maps, Google Maps plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 8.14.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...
The MapSVG – Vector maps, Image maps, Google Maps plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 8.14.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the...
The MapSVG – Vector maps, Image maps, Google Maps plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 8.14.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, wit...
The MapSVG – Vector maps, Image maps, Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 8.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...
The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible for authenticated atta...
The MapSVG – Vector maps, Image maps, Google Maps plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 8.7.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the af...
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows DOM-Based XSS.This issue affects MapSVG: from n/a through <= 8.7.15.
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 8.7.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wil...
The The MapSVG – Vector maps, Image maps, Google Maps plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.6.9. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possib...
[en] Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG Lite allows Code Injection. This issue affects MapSVG Lite: from n/a through 8.6.4.
[en] Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG Lite allows Upload a Web Shell to a Web Server. This issue affects MapSVG Lite: from n/a through 8.5.34.
The MapSVG – Vector maps, Image maps, Google Maps plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 8.6.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the af...
The MapSVG Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...
The MapSVG – Vector maps, Image maps, Google Maps plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 8.6.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized...
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG Lite allows DOM-Based XSS. This issue affects MapSVG Lite: from n/a through 8.5.32.
[en] Missing Authorization vulnerability in RomanCode MapSVG Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MapSVG Lite: from n/a through 8.5.32.
MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that can result in an attacker modifying post data, including embedding javascript. This attack appears to be exploitable via a victim who must be logged in to WordPre...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free