CVE-2025-32683: WordPress MapSVG Lite plugin <= 8.6.6 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG Lite allows DOM-Based XSS. This issue affects MapSVG Lite: from n/a through 8.5.32.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows DOM-Based XSS.This issue affects MapSVG: from n/a through <= 8.6.6.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32683?
CVE-2025-32683 is classified as a high severity vulnerability due to its potential for allowing DOM-Based Cross-site Scripting (XSS).
How do I fix CVE-2025-32683?
To fix CVE-2025-32683, update the MapSVG Lite plugin to version 8.5.33 or later, which includes a patch for the vulnerability.
What impact does CVE-2025-32683 have on website security?
The impact of CVE-2025-32683 includes the potential exploitation of Cross-site Scripting (XSS) attacks, which can compromise user data and site integrity.
Is my website vulnerable to CVE-2025-32683?
If you are using RomanCode MapSVG Lite or WordPress MapSVG Lite versions up to and including 8.5.32, your website is vulnerable to CVE-2025-32683.
Who is affected by CVE-2025-32683?
Users of MapSVG Lite, both from RomanCode and WordPress, are affected by CVE-2025-32683 if they are on versions up to 8.5.32.