Live › vulnerability › CVE-2026-111399
Go to dashboardThe MapSVG interactive vector maps plugin for WordPress fails to neutralize special SQL characters in input, enabling SQL injection. An attacker who can reach the vulnerable request can read or alter the site database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the MapSVG (mapsvg-lite-interactive-vector-maps) WordPress plugin at version 8.16.1 or earlier are affected. Sites that do not have the plugin installed can skip this. Whether an unauthenticated attacker can reach the flawed request is not stated in the sources.
No product ranges from the sources yet.
mapsvg-lite-interactive-vector-maps plugin in the WordPress admin plugin list or wp plugin get mapsvg-lite-interactive-vector-maps --field=version8.16.1; versions up to and including 8.16.1 are listed as affectedmapsvg-lite-interactive-vector-maps plugin to a version newer than 8.16.1 once the vendor releases one; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-111399")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.