Live › vulnerability › CVE-2026-111405
Go to dashboardThe MapSVG Interactive Vector Maps plugin for WordPress (mapsvg-lite-interactive-vector-maps) fails to neutralize user input in generated pages, enabling stored cross-site scripting. An attacker who can submit that input can run scripts in the browser of anyone who views the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the MapSVG Lite Interactive Vector Maps WordPress plugin at version 8.16.1 or earlier are exposed. The stored input path is what matters, so sites where only trusted administrators can edit map content are at lower practical risk. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
wp-content/plugins/mapsvg-lite-interactive-vector-maps/.8.16.1 is installed.8.16.1; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 8.16.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-111405")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.