WordPress Plugin Vulnerabilities

MapSVG Lite < 8.6.10 - Unauthenticated Arbitrary Shortcode Execution

Description

The plugin is vulnerable to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Affects Plugins

Plugin icon
mapsvg-lite-interactive-vector-maps
Fixed in 8.6.10

References

CVE
CVE-2025-48120
URL
https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-lite-plugin-8-5-41-arbitrary-shortcode-execution-vulnerability

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Trương Hữu Phúc (truonghuuphuc)
Verified
No
WPVDB ID
88ba7ae2-af4c-4b5b-9766-0e11215e4421

Timeline

Publicly Published
2025-05-16 (about 1 year ago)
Added
2025-05-20 (about 1 year ago)
Last Updated
2025-06-12 (about 1 year ago)

Other

Published
Title
Published
2024-09-09
Title
Frontend Dashboard < 2.2.5 - Authenticated (Subscriber+) Arbitrary Function Call
Published
2024-12-03
Title
Authors List < 2.0.5 - Unauthenticated Arbitrary Shortcode Execution
Published
2014-08-01
Title
BackWPup 2.1.4 - Code Execution
Published
2016-08-02
Title
wSecure Lite <= 2.3 - Remote Code Execution (RCE)
Published
2026-02-17
Title
Product Addons for Woocommerce – Product Options with Custom Fields < 3.1.1 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter