Romancode
Monthly
Unauthenticated SQL injection in the MapSVG WordPress plugin up to version 8.14.0 allows remote attackers to extract sensitive data from the database without credentials. The vulnerability can be triggered via specially crafted requests and has a critical CVSS score of 9.3. No public exploit code or active exploitation has been reported at the time of analysis.
SQL injection in the MapSVG WordPress plugin (versions <= 8.14.0) allows an authenticated user holding at least Contributor privileges to inject arbitrary SQL into backend database queries (CWE-89). Reported by Patchstack and rated CVSS 8.5, the flaw enables extraction of sensitive database contents such as WordPress user records and password hashes. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows Contributor-level authenticated users to inject arbitrary SQL through an unsanitized parameter (CWE-89), exposing the WordPress database. Because Contributor is a low-privilege role that many blogs and multi-author sites grant liberally, an attacker with such an account can read sensitive data including user credentials and secret keys. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but SQLi in WordPress plugins is a well-understood, easily weaponized class once details are public.
SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing the WordPress database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though no public exploit has been identified at time of analysis. Any WordPress site running a vulnerable MapSVG build is directly exposed to database extraction over the network.
Cross-site scripting in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows authenticated Contributor-level users to inject malicious JavaScript that executes in the browsers of higher-privileged users who view the affected content. The scope change in the CVSS vector confirms the injected script escapes the plugin's context and can compromise the victim's browser session, enabling session hijacking or unauthorized administrative actions. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated SQL injection in the MapSVG WordPress plugin up to version 8.14.0 allows remote attackers to extract sensitive data from the database without credentials. The vulnerability can be triggered via specially crafted requests and has a critical CVSS score of 9.3. No public exploit code or active exploitation has been reported at the time of analysis.
SQL injection in the MapSVG WordPress plugin (versions <= 8.14.0) allows an authenticated user holding at least Contributor privileges to inject arbitrary SQL into backend database queries (CWE-89). Reported by Patchstack and rated CVSS 8.5, the flaw enables extraction of sensitive database contents such as WordPress user records and password hashes. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows Contributor-level authenticated users to inject arbitrary SQL through an unsanitized parameter (CWE-89), exposing the WordPress database. Because Contributor is a low-privilege role that many blogs and multi-author sites grant liberally, an attacker with such an account can read sensitive data including user credentials and secret keys. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but SQLi in WordPress plugins is a well-understood, easily weaponized class once details are public.
SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing the WordPress database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though no public exploit has been identified at time of analysis. Any WordPress site running a vulnerable MapSVG build is directly exposed to database extraction over the network.
Cross-site scripting in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows authenticated Contributor-level users to inject malicious JavaScript that executes in the browsers of higher-privileged users who view the affected content. The scope change in the CVSS vector confirms the injected script escapes the plugin's context and can compromise the victim's browser session, enabling session hijacking or unauthorized administrative actions. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.