WordPress Plugin Vulnerabilities

MapSVG – Vector maps, Image maps, Google Maps < 8.16.0 - Unauthenticated Server-Side Request Forgery

Description

The MapSVG – Vector maps, Image maps, Google Maps plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 8.15.0. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
mapsvg-lite-interactive-vector-maps
Fixed in 8.16.0

References

CVE
CVE-2026-82852
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/cdfac55e-3271-4299-a956-41bd723b9daf

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Adam Kahlon
Verified
No
WPVDB ID
e646e8e4-80b7-49b7-bd24-bbab8c548c42

Timeline

Publicly Published
2026-08-31 (about 1 month ago)
Added
2026-09-10 (about 1 month ago)
Last Updated
2026-09-10 (about 1 month ago)

Other

Published
Title
Published
2026-07-22
Title
Photo Block – A Modern Image Block With Lightbox and Caption Support <= 1.7.1 - Authenticated (Author+) Sever-Side Request Forgery
Published
2025-03-19
Title
Order Export & Order Import for WooCommerce < 2.6.1 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
Published
2026-07-22
Title
JetEngine < 3.8.12 - Authenticated (Contributor+) Sever-Side Request Forgery
Published
2025-09-22
Title
Content Mask < 1.8.5.3 - Authenticated (Contributor+) Server-Side Request Forgery
Published
2024-04-22
Title
Embed Google Photos album < 2.2.1 - Authenticated (Contributor+) Server-Side Request Forgery