CVE-2026-65449

The MapSVG plugin up to version 8.14.0 contains an SQL injection vulnerability exploitable by a contributor-level user. An attacker can manipulate database queries.

The MapSVG plugin up to version 8.14.0 contains an SQL injection vulnerability exploitable by a contributor-level user. An attacker can manipulate database queries.

The MapSVG plugin version 8.14.0 and earlier contains an SQL injection vulnerability exploitable by an unauthenticated attacker.

MapSVG versions up to 8.14.0 contain an Administrator Arbitrary File Upload vulnerability. An administrator can upload a malicious file, potentially leading to remote code execution on the server.

The MapSVG plugin versions up to 8.14.0 are vulnerable to unauthenticated SQL injection.

MapSVG versions up to 8.15.0 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can make the server send requests to arbitrary resources, including internal ones, without authentication.

The MapSVG plugin for WordPress up to version 8.14.0 is vulnerable to stored XSS via user-supplied attributes in map options. Insufficient sanitization and escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute on every visit to the injected page.

Arbitrary file upload vulnerability in MapSVG plugin for WordPress (all versions up to 8.14.0) due to missing file type validation in SVGFile constructor. Requires admin access.

The MapSVG plugin for WordPress (versions up to 8.7.22) is vulnerable to DOM-Based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability arises from insufficient encoding of user-supplied data, allowing execution of malicious scripts in the victim's browser.