{"id":"CVE-2026-111405","kind":"vulnerability","aliases":["CVE-2026-111405"],"related":[],"title":"MapSVG WordPress plugin: stored XSS through input up to 8.16.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 8.16.1.","summary":"The MapSVG Interactive Vector Maps plugin for WordPress (mapsvg-lite-interactive-vector-maps) fails to neutralize user input in generated pages, enabling stored cross-site scripting. An attacker who can submit that input can run scripts in the browser of anyone who views the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mapsvg","package","self-hosted","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/mapsvg-lite-interactive-vector-maps/`.\n- Confirm whether any version up to and including `8.16.1` is installed.","fix":"- Update the MapSVG plugin (mapsvg-lite-interactive-vector-maps) to a version later than `8.16.1`; the fixed version is unknown from the sources.\n- If no fixed version is available, deactivate the plugin until one is released.","status":"open","published_at":"2026-10-16T13:16:55+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:57:53+00:00","updated_at":"2026-10-25T03:57:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:57:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the MapSVG plugin (mapsvg-lite-interactive-vector-maps) to a version later than `8.16.1`; the fixed version is unknown from the sources.\n- If no fixed version is available, deactivate the plugin until one is released.","reach":"internet","title":"MapSVG WordPress plugin: stored XSS through input up to 8.16.1","impact":"medium","summary":"The MapSVG Interactive Vector Maps plugin for WordPress (mapsvg-lite-interactive-vector-maps) fails to neutralize user input in generated pages, enabling stored cross-site scripting. An attacker who can submit that input can run scripts in the browser of anyone who views the affected page.","category":"package","nicknames":[],"who_cares":["wordpress","mapsvg","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' browsers on the affected site.","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version, the required privilege level, and whether a visitor must load the page.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/mapsvg-lite-interactive-vector-maps/`.\n- Confirm whether any version up to and including `8.16.1` is installed.","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the MapSVG Lite Interactive Vector Maps WordPress plugin at version 8.16.1 or earlier are exposed. The stored input path is what matters, so sites where only trusted administrators can edit map content are at lower practical risk. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00066,"input_tokens":3325,"output_tokens":655,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111405':13A,16A '-2026':12A,15A '8.16.1':10A,105C 'affect':69B,100C 'allow':96C 'anyon':65B 'attack':52B 'browser':63B 'cross':48B,80C 'cross-sit':47B,79C 'cve':11A,14A 'enabl':45B 'fail':37B 'generat':43B,78C 'host':21B 'improp':71C 'input':7A,41B,57B,74C 'interact':25B,34B,93C 'issu':99C 'light':87C 'lite':33B,92C 'map':27B,36B,95C 'mapsvg':1A,17B,24B,32B,89C,91C,101C 'mapsvg-lite-interactive-vector-map':31B,90C 'n/a':103C 'neutral':39B,72C 'norther':86C 'packag':18B 'page':44B,70B,77C 'plugin':3A,28B 'product':88C 'pt':85C 'run':59B 'script':50B,60B,82C 'self':20B 'self-host':19B 'site':49B,81C 'store':4A,46B,97C 'submit':55B 'user':40B 'vector':26B,35B,94C 'view':67B 'vulner':83C 'web':76C 'wordpress':2A,22B,30B 'xss':5A 'xss.this':98C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MapSVG Lite Interactive Vector Maps WordPress plugin at version 8.16.1 or earlier are exposed. The stored input path is what matters, so sites where only trusted administrators can edit map content are at lower practical risk. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111405","severity":null,"published_at":"2026-10-16T13:16:55+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}