Mapsvg
Monthly
Unauthenticated SQL injection in the MapSVG WordPress plugin up to version 8.14.0 allows remote attackers to extract sensitive data from the database without credentials. The vulnerability can be triggered via specially crafted requests and has a critical CVSS score of 9.3. No public exploit code or active exploitation has been reported at the time of analysis.
Arbitrary file upload in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows an authenticated administrator to upload files of unrestricted type, enabling execution of attacker-supplied code (e.g. a PHP webshell) on the hosting server. Reported by Patchstack and classified as CWE-434, the flaw carries a CVSS 9.1 owing to a scope change, but the PR:H requirement means only accounts already holding administrator privileges can trigger it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the MapSVG WordPress plugin (versions <= 8.14.0) allows an authenticated user holding at least Contributor privileges to inject arbitrary SQL into backend database queries (CWE-89). Reported by Patchstack and rated CVSS 8.5, the flaw enables extraction of sensitive database contents such as WordPress user records and password hashes. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows Contributor-level authenticated users to inject arbitrary SQL through an unsanitized parameter (CWE-89), exposing the WordPress database. Because Contributor is a low-privilege role that many blogs and multi-author sites grant liberally, an attacker with such an account can read sensitive data including user credentials and secret keys. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but SQLi in WordPress plugins is a well-understood, easily weaponized class once details are public.
SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing the WordPress database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though no public exploit has been identified at time of analysis. Any WordPress site running a vulnerable MapSVG build is directly exposed to database extraction over the network.
Server-Side Request Forgery in the MapSVG WordPress plugin (versions <= 8.15.0) exposes the hosting WordPress server as a proxy to internal or adjacent network resources, reachable without authentication. The CVSS scope-change indicator (S:C) confirms that successful exploitation can cause the server to issue requests beyond the WordPress application boundary, potentially exposing internal APIs, cloud metadata endpoints, or intranet services. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Cross-site scripting in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows authenticated Contributor-level users to inject malicious JavaScript that executes in the browsers of higher-privileged users who view the affected content. The scope change in the CVSS vector confirms the injected script escapes the plugin's context and can compromise the victim's browser session, enabling session hijacking or unauthorized administrative actions. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that can result in an attacker can modify post. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated SQL injection in the MapSVG WordPress plugin up to version 8.14.0 allows remote attackers to extract sensitive data from the database without credentials. The vulnerability can be triggered via specially crafted requests and has a critical CVSS score of 9.3. No public exploit code or active exploitation has been reported at the time of analysis.
Arbitrary file upload in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows an authenticated administrator to upload files of unrestricted type, enabling execution of attacker-supplied code (e.g. a PHP webshell) on the hosting server. Reported by Patchstack and classified as CWE-434, the flaw carries a CVSS 9.1 owing to a scope change, but the PR:H requirement means only accounts already holding administrator privileges can trigger it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the MapSVG WordPress plugin (versions <= 8.14.0) allows an authenticated user holding at least Contributor privileges to inject arbitrary SQL into backend database queries (CWE-89). Reported by Patchstack and rated CVSS 8.5, the flaw enables extraction of sensitive database contents such as WordPress user records and password hashes. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows Contributor-level authenticated users to inject arbitrary SQL through an unsanitized parameter (CWE-89), exposing the WordPress database. Because Contributor is a low-privilege role that many blogs and multi-author sites grant liberally, an attacker with such an account can read sensitive data including user credentials and secret keys. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but SQLi in WordPress plugins is a well-understood, easily weaponized class once details are public.
SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing the WordPress database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though no public exploit has been identified at time of analysis. Any WordPress site running a vulnerable MapSVG build is directly exposed to database extraction over the network.
Server-Side Request Forgery in the MapSVG WordPress plugin (versions <= 8.15.0) exposes the hosting WordPress server as a proxy to internal or adjacent network resources, reachable without authentication. The CVSS scope-change indicator (S:C) confirms that successful exploitation can cause the server to issue requests beyond the WordPress application boundary, potentially exposing internal APIs, cloud metadata endpoints, or intranet services. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Cross-site scripting in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows authenticated Contributor-level users to inject malicious JavaScript that executes in the browsers of higher-privileged users who view the affected content. The scope change in the CVSS vector confirms the injected script escapes the plugin's context and can compromise the victim's browser session, enabling session hijacking or unauthorized administrative actions. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that can result in an attacker can modify post. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.