CVE-2026-111405: WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 8.16.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress MapSVG pluginto a version that resolves this vulnerability.Fixed in 8.16.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs at least low-level privileges and user interaction to exploit the stored XSS issue. The attack can be conducted over the network with low attack complexity.
What impact can successful exploitation have?
The vulnerability is rated medium severity with a CVSS score of 6.5. Its vector indicates low confidentiality, integrity, and availability impact, with scope changed.
Which installations are affected?
MapSVG versions through 8.16.1 are affected. The available data does not identify a fixed version or any configuration conditions that would prevent exposure.