CVE-2025-48120: WordPress MapSVG Lite plugin <= 8.6.9 - Arbitrary Shortcode Execution vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG Lite allows Code Injection. This issue affects MapSVG Lite: from n/a through 8.6.4.
Other sources
Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue affects MapSVG: from n/a through <= 8.6.9.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48120?
CVE-2025-48120 is regarded as a high severity vulnerability due to the potential for code injection.
How do I fix CVE-2025-48120?
To fix CVE-2025-48120, ensure that you upgrade to MapSVG Lite version 8.6.5 or later.
What type of vulnerability is CVE-2025-48120?
CVE-2025-48120 is classified as a code injection vulnerability affecting MapSVG Lite.
Which versions of MapSVG Lite are affected by CVE-2025-48120?
CVE-2025-48120 affects all versions of MapSVG Lite from an unspecified version up to 8.6.4.
What can an attacker do exploiting CVE-2025-48120?
An attacker exploiting CVE-2025-48120 could execute arbitrary code on the server, leading to serious security breaches.