CVE-2026-125816: WordPress MapSVG plugin <= 9.0.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 9.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.5
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that the attacker needs low-level privileges (PR:L) and that user interaction is required (UI:R). Exploitation is network-accessible and has low attack complexity.
What impact could successful exploitation have?
Successful stored XSS could affect confidentiality, integrity, and availability at a low level. The scope is changed (S:C), meaning the impact can extend beyond the vulnerable component's security authority.
Which MapSVG versions are affected?
MapSVG versions through 9.0.4 are affected. The available data does not identify a fixed version.