What is the CVSS score of CVE-2026-65449?

CVE-2026-65449 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

MapSVG CVE-2026-65449

EUVD-2026-48214 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-5mr2-56r2-qr4x

WordPress XSS Wordpress Plugin Mapsvg Romancode

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor auth required (PR:L), victim must view injected content (UI:R), scope changes to victim's browser (S:C); XSS does not produce availability impact so A:N.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:30 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.

AnalysisAI

Cross-site scripting in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows authenticated Contributor-level users to inject malicious JavaScript that executes in the browsers of higher-privileged users who view the affected content. The scope change in the CVSS vector confirms the injected script escapes the plugin's context and can compromise the victim's browser session, enabling session hijacking or unauthorized administrative actions. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

MapSVG (vendor: romancode, CPE: cpe:2.3:a:romancode:mapsvg:*:*:*:*:*:*:*:*) is a WordPress plugin providing interactive SVG-based maps and floor plan functionality. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), meaning the plugin fails to sanitize or escape user-supplied input before rendering it in the browser. The CVSS scope change metric (S:C) indicates the injected script escapes the plugin's sandbox and affects the broader browser context of users who encounter the malicious content, consistent with stored XSS where Contributor-submitted content is later rendered for editors or administrators.

RemediationAI

Update the MapSVG plugin to a version above 8.14.0; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-14-0-cross-site-scripting-xss-vulnerability should be checked for the confirmed patched release version, as no exact fix version number is available in the current dataset - patch availability per vendor advisory is assumed given 8.14.0 is listed as the last vulnerable release, but this has not been independently verified. As a compensating control on multi-user sites while awaiting confirmation, restrict or remove the Contributor role from any users who do not require it, which eliminates the low-privilege requirement (PR:L) and fully mitigates this attack path. Alternatively, disabling the MapSVG plugin removes the vulnerability surface entirely, at the cost of all interactive map functionality. WordPress Content Security Policy headers can reduce XSS impact but will not eliminate the vulnerability.