CVE-2026-111398
HighCVSS 7.7Summary
The MapSVG plugin for WordPress (versions up to 8.16.1) contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. This may allow an attacker to access files outside the intended directory.
Risk Assessment
An attacker could read sensitive files from the server, potentially leading to data leakage or further attack escalation.
Recommendation
Update the MapSVG plugin to the latest version that fixes this vulnerability. If updating is not possible, consider disabling the plugin.
Other vulnerabilities in MapSVG
See all- CVE-2026-111405Medium
The MapSVG plugin contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 8.16.1.
- CVE-2026-111399High
The MapSVG plugin (mapsvg-lite-interactive-vector-maps) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects versions from n/a through 8.16.1.
- CVE-2026-111397Medium
The MapSVG plugin contains a Missing Authorization vulnerability that allows retrieval of embedded sensitive data. This issue affects versions from n/a through 8.16.1.
- CVE-2026-65451High
The MapSVG plugin up to version 8.14.0 contains an SQL injection vulnerability exploitable by a contributor-level user. An attacker can manipulate database queries.
- CVE-2026-65450High
The MapSVG plugin up to version 8.14.0 contains an SQL injection vulnerability exploitable by a contributor-level user. An attacker can manipulate database queries.
- CVE-2026-65449Medium
The MapSVG plugin version 8.14.0 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. An attacker with contributor role can inject malicious JavaScript.
- CVE-2026-111406Critical
The MapSVG plugin (interactive vector maps for WordPress) through 8.16.1 allows unrestricted upload of files with dangerous types. This enables an attacker to upload and execute a web shell on the web server.
- CVE-2026-59527Critical
The MapSVG plugin version 8.14.0 and earlier contains an SQL injection vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-65455Critical
MapSVG versions up to 8.14.0 contain an Administrator Arbitrary File Upload vulnerability. An administrator can upload a malicious file, potentially leading to remote code execution on the server.
- CVE-2026-59526Critical
The MapSVG plugin versions up to 8.14.0 are vulnerable to unauthenticated SQL injection.
Original NVD description (English source)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS