WordPress Plugin Vulnerabilities

MapSVG < 8.7.23 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
mapsvg-lite-interactive-vector-maps
Fixed in 8.7.23

References

CVE
CVE-2025-62930
URL
https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-7-15-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Gilang Asra Bilhadi - DJ
Verified
No
WPVDB ID
ce2c7d17-138e-4cbe-b462-8c0eb952d2d8

Timeline

Publicly Published
2025-10-06 (about 11 months ago)
Added
2025-10-29 (about 10 months ago)
Last Updated
2025-11-24 (about 9 months ago)

Other

Published
Title
Published
2021-09-10
Title
Appointment Hour Booking – WordPress Booking Plugin < 1.3.17 - Authenticated Stored XSS
Published
2025-07-18
Title
Partnerský systém Martinus <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-06-05
Title
WordPress Ajax Load More and Infinite Scroll <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Published
2025-01-29
Title
Master Slider < 3.10.5 - Editor+ Stored XSS
Published
2015-01-01
Title
WP Responsive Preview - XSS