What is the CVSS score of EUVD-2025-210507?

EUVD-2025-210507 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

MapSVG WordPress Plugin EUVD-2025-210507

| CVE-2025-9205 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-24 Wordfence

GHSA-39xj-89xc-9j56

WordPress XSS Wordpress Plugin Mapsvg Vector Maps Image Maps Google Maps

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires a victim to visit the injected page (UI:R, not UI:N); contributor authentication is required (PR:L); scope changes to victim's browser context (S:C).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:04 vuln.today

CVE Published

Jul 24, 2026 - 02:31 cve.org

MEDIUM 6.4

DescriptionCVE.org

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the MapSVG plugin for WordPress (versions up to and including 8.14.0) allows contributor-level authenticated attackers to permanently inject arbitrary JavaScript via unsanitized map option attributes. The injected payload persists in the database and executes in any visitor's browser upon accessing an affected page, resulting in a scope change where the attacker's code runs in the context of higher-privileged users such as administrators. No public exploit identified at time of analysis, but contributor-level access is commonly obtainable on sites allowing open registration.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant. The MapSVG plugin (developed by Oyatek, CPE: cpe:2.3:a:oyatek:mapsvg_-_vector_maps,_image_maps,_google_maps:*:*:*:*:*:*:*:*) processes user-supplied attributes within map configuration options and fails to apply sufficient sanitization on input or proper contextual escaping on output. The flaw has been traced to the Admin.php file at line 233 in the plugin's administrative handler, as referenced in the WordPress plugin Trac source browser. Because map options are stored server-side and rendered into page HTML, malicious script content survives page loads and executes for every subsequent visitor - the defining characteristic of stored (persistent) XSS as opposed to reflected XSS.

RemediationAI

Site administrators should update the MapSVG plugin to a version above 8.14.0 immediately. A fix has been committed to the WordPress plugin repository as confirmed by Trac changeset 3608308 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3608308%40mapsvg-lite-interactive-vector-maps&new=3608308%40mapsvg-lite-interactive-vector-maps); however, the exact patched release version number is not independently confirmed from the available data - consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a2dab9d3-a890-4c66-a825-e30329e37a60 for the confirmed fixed version. As a compensating control pending patch application, administrators should audit and restrict contributor-level account registration and review existing contributor accounts for unauthorized activity. Reducing the contributor role's ability to interact with MapSVG map options - if the plugin's access controls permit this - would further limit exposure. Note that removing contributor access site-wide may impact legitimate editorial workflows.