MapSVG – Vector maps, Image maps, Google Maps

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   MapSVG – Vector maps, Image maps, Google Maps

Information

Software Type Plugin
Software Slug mapsvg-lite-interactive-vector-maps (view on wordpress.org)
Software Status Active
Software Author oyatek
Software Website mapsvg.com
Software Downloads 70,186
Software Active Installs 1,000
Software Record Last Updated August 20, 2026

13 Vulnerabilities

Submit a Vulnerability
MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-9205
Jul 23, 2026
Researcher: zer0gh0st
MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Unauthenticated SQL Injection
7.5
CVE-2026-59527
Jul 23, 2026
Researcher: Trương Hữu Phúc (truonghuuphuc)
MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2026-65450
Jul 22, 2026
Researcher: Trương Hữu Phúc (truonghuuphuc)
MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-65449
Jul 22, 2026
Researcher: johska
MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Admin+) Arbitrary File Upload
7.2
CVE-2026-65455
Jul 22, 2026
Researcher: Securepeak Research Team
MapSVG <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint
7.2
CVE-2026-1771
Jul 20, 2026
Researcher: san6051
MapSVG <= 8.7.3 - Authenticated (Contributor+) Arbitrary File Upload
8.8
CVE-2025-68562
Dec 24, 2025
Researcher: stealthcopter
MapSVG <= 8.7.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-62930
Oct 6, 2025
Researcher: Gilang Asra Bilhadi - DJ
MapSVG Lite <= 8.6.9 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVE-2025-48120
May 16, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
MapSVG Lite <= 8.6.4 - Authenticated (Contributor+) Arbitrary File Upload
8.8
CVE-2025-32682
Apr 15, 2025
Researcher: Nguyễn Trung Kiên
MapSVG Lite <= 8.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-32683
Apr 9, 2025
Researcher: Nguyễn Trung Kiên
MapSVG Lite <= 8.6.4 - Missing Authorization
4.3
CVE-2025-32684
Apr 9, 2025
Researcher: Nguyễn Trung Kiên
MapSVG Lite < 3.3.0 - Cross-Site Request Forgery
6.1
CVE-2019-1000003
Jan 8, 2019
Researcher: Rob Skilling (DXW)
Title Status CVE ID CVSS Researchers Date
MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-9205 6.4 zer0gh0st July 23, 2026
MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Unauthenticated SQL Injection Patched CVE-2026-59527 7.5 Trương Hữu Phúc (truonghuuphuc) July 23, 2026
MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Contributor+) SQL Injection Patched CVE-2026-65450 6.5 Trương Hữu Phúc (truonghuuphuc) July 22, 2026
MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-65449 6.4 johska July 22, 2026
MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Admin+) Arbitrary File Upload Patched CVE-2026-65455 7.2 Securepeak Research Team July 22, 2026
MapSVG <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint Patched CVE-2026-1771 7.2 san6051 July 20, 2026
MapSVG <= 8.7.3 - Authenticated (Contributor+) Arbitrary File Upload Patched CVE-2025-68562 8.8 stealthcopter December 24, 2025
MapSVG <= 8.7.23 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-62930 6.4 Gilang Asra Bilhadi - DJ October 6, 2025
MapSVG Lite <= 8.6.9 - Unauthenticated Arbitrary Shortcode Execution Patched CVE-2025-48120 6.5 Trương Hữu Phúc (truonghuuphuc) May 16, 2025
MapSVG Lite <= 8.6.4 - Authenticated (Contributor+) Arbitrary File Upload Patched CVE-2025-32682 8.8 Nguyễn Trung Kiên April 15, 2025
MapSVG Lite <= 8.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-32683 6.4 Nguyễn Trung Kiên April 9, 2025
MapSVG Lite <= 8.6.4 - Missing Authorization Patched CVE-2025-32684 4.3 Nguyễn Trung Kiên April 9, 2025
MapSVG Lite < 3.3.0 - Cross-Site Request Forgery Patched CVE-2019-1000003 6.1 Rob Skilling (DXW) January 8, 2019

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation