MapSVG CVE-2026-111405

Requires an attacker to hold an authenticated WordPress account with at least low-privilege access sufficient to submit or edit MapSVG map/input data (PR:L), on a site running MapSVG (mapsvg-lite-interactive-vector-maps) version n/a through 8.16.1. The stored payload only fires when another user - typically an administrator or editor - subsequently views the page rendering the unsanitized input (UI:R), making privileged-victim interaction the key limiting factor. Exploitation is bounded by the need for pre-existing authenticated access and by whether the site grants content-entry roles to untrusted users; it does not work against anonymous visitors or default no-untrusted-user deployments.

This is a moderate-severity Stored XSS (CWE-79) in the MapSVG WordPress plugin, scored CVSS 6.5. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) tells a consistent story: network-reachable and low-complexity, but it requires an already-authenticated low-privilege account (PR:L) AND victim interaction (UI:R), with a scope change (S:C) typical of XSS where injected script executes in another user's browser context. Impacts are only Low across confidentiality, integrity, and availability. On the real-world signal side, the data is thin: no EPSS probability, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description - both point to an authenticated stored-injection flaw requiring a privileged victim to trigger it. Bottom line: this is a real but not top-tier priority. It is not a remote-unauthenticated mass-exploitation candidate; the PR:L + UI:R gating plus Low impacts make it a routine-patch item rather than an emergency, best weighted by how many untrusted low-privilege users a given WordPress site grants content-entry access to.

A WordPress user with low-privilege content access (e.g., a contributor or an authenticated user permitted to edit MapSVG map data) injects a malicious JavaScript payload into a plugin input field that is stored and not properly sanitized. When an administrator or another user later views the affected map or admin page, the script executes in their browser session, potentially enabling session/cookie theft or actions in their context. No public exploit code was identified in the provided data.