CVE-2026-1771
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Arbitrary file upload vulnerability in MapSVG plugin for WordPress (all versions up to 8.14.0) due to missing file type validation in SVGFile constructor. Requires admin access.
Risk Assessment
An authenticated attacker with admin privileges can upload a malicious file and achieve remote code execution on the server.
Recommendation
Update the MapSVG plugin to version 8.14.1 or later.
Other vulnerabilities in MapSVG
See all- CVE-2026-65451High
The MapSVG plugin up to version 8.14.0 contains an SQL injection vulnerability exploitable by a contributor-level user. An attacker can manipulate database queries.
- CVE-2026-65450High
The MapSVG plugin up to version 8.14.0 contains an SQL injection vulnerability exploitable by a contributor-level user. An attacker can manipulate database queries.
- CVE-2026-65449Medium
The MapSVG plugin version 8.14.0 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. An attacker with contributor role can inject malicious JavaScript.
- CVE-2026-59527Critical
The MapSVG plugin version 8.14.0 and earlier contains an SQL injection vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-65455Critical
MapSVG versions up to 8.14.0 contain an Administrator Arbitrary File Upload vulnerability. An administrator can upload a malicious file, potentially leading to remote code execution on the server.
- CVE-2026-59526Critical
The MapSVG plugin versions up to 8.14.0 are vulnerable to unauthenticated SQL injection.
- CVE-2025-9205Medium
The MapSVG plugin for WordPress up to version 8.14.0 is vulnerable to stored XSS via user-supplied attributes in map options. Insufficient sanitization and escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute on every visit to the injected page.
Original NVD description (English source)
The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.