{"id":"CVE-2026-125816","kind":"vulnerability","aliases":["CVE-2026-125816"],"related":[],"title":"MapSVG WordPress plugin: stored XSS through versions up to 9.0.4","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 9.0.4.","summary":"MapSVG (mapsvg-lite-interactive-vector-maps) fails to neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can store input in the plugin can run scripts in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mapsvg","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `mapsvg-lite-interactive-vector-maps` plugin is installed on the WordPress site and note its version.\n- Confirm the installed MapSVG version is `9.0.4` or lower, as stated in the affected range.","fix":null,"status":"open","published_at":"2026-11-13T13:18:21+00:00","first_seen_at":"2026-11-13T13:46:52+00:00","triaged_at":"2026-11-13T13:47:57+00:00","updated_at":"2026-11-13T13:47:57+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T13:47:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MapSVG WordPress plugin: stored XSS through versions up to 9.0.4","impact":"medium","summary":"MapSVG (mapsvg-lite-interactive-vector-maps) fails to neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can store input in the plugin can run scripts in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mapsvg","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' browsers on the site","analyst_note":"Confirm the fixed version and which user role can store the input, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125816 and the plugin vendor's changelog.","how_to_check":"- Check whether the `mapsvg-lite-interactive-vector-maps` plugin is installed on the WordPress site and note its version.\n- Confirm the installed MapSVG version is `9.0.4` or lower, as stated in the affected range.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the MapSVG plugin at version 9.0.4 or earlier are affected, as the description gives the range 'from n/a through 9.0.4'. The sources do not say what user roles can submit the stored input, so exposure depends on who can write content to the plugin. Sites without the plugin can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4561,"output_tokens":594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125816':13A,16A '-2026':12A,15A '9.0.4':10A,94C 'affect':89C 'allow':38B,85C 'attack':45B 'browser':59B 'cross':41B,69C 'cross-sit':40B,68C 'cve':11A,14A 'fail':30B 'generat':35B,67C 'host':21B 'improp':60C 'input':33B,49B,63C 'interact':27B,82C 'issu':88C 'light':76C 'lite':26B,81C 'map':29B,84C 'mapsvg':1A,17B,23B,25B,78C,80C,90C 'mapsvg-lite-interactive-vector-map':24B,79C 'n/a':92C 'neutral':32B,61C 'norther':75C 'packag':18B 'page':37B,66C 'plugin':3A,52B 'product':77C 'pt':74C 'run':54B 'script':43B,55B,71C 'self':20B 'self-host':19B 'site':42B,70C 'store':4A,39B,48B,86C 'vector':28B,83C 'version':7A 'visitor':58B 'vulner':72C 'web':36B,65C 'wordpress':2A,22B 'xss':5A 'xss.this':87C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MapSVG plugin at version 9.0.4 or earlier are affected, as the description gives the range 'from n/a through 9.0.4'. The sources do not say what user roles can submit the stored input, so exposure depends on who can write content to the plugin. Sites without the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["mapsvg","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-125816':13A,16A '-2026':12A,15A '9.0.4':10A 'cve':11A,14A 'mapsvg':1A 'plugin':3A 'store':4A 'version':7A 'wordpress':2A 'xss':5A","search_b":"'allow':38B 'attack':45B 'browser':59B 'cross':41B 'cross-sit':40B 'fail':30B 'generat':35B 'host':21B 'input':33B,49B 'interact':27B 'lite':26B 'map':29B 'mapsvg':17B,23B,25B 'mapsvg-lite-interactive-vector-map':24B 'neutral':32B 'packag':18B 'page':37B 'plugin':52B 'run':54B 'script':43B,55B 'self':20B 'self-host':19B 'site':42B 'store':39B,48B 'vector':28B 'visitor':58B 'web':36B 'wordpress':22B","search_c":"'9.0.4':94C 'affect':89C 'allow':85C 'cross':69C 'cross-sit':68C 'generat':67C 'improp':60C 'input':63C 'interact':82C 'issu':88C 'light':76C 'lite':81C 'map':84C 'mapsvg':78C,80C,90C 'mapsvg-lite-interactive-vector-map':79C 'n/a':92C 'neutral':61C 'norther':75C 'page':66C 'product':77C 'pt':74C 'script':71C 'site':70C 'store':86C 'vector':83C 'vulner':72C 'web':65C 'xss.this':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T13:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125816","severity":null,"published_at":"2026-11-13T13:18:21+00:00","modified_at":"2026-11-13T13:18:21+00:00","first_seen_at":"2026-11-13T13:46:52+00:00","fetched_at":"2026-11-13T13:46:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}