{"id":"CVE-2026-125821","kind":"vulnerability","aliases":["CVE-2026-125821"],"related":[],"title":"MapSVG WordPress plugin: stored script injection through web page content","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue affects MapSVG: from n/a through 9.0.4.","summary":"MapSVG (mapsvg-lite-interactive-vector-maps) fails to neutralize script-related HTML tags on a web page, a basic cross-site scripting flaw. An attacker who can supply content to the page can run scripts in visitors' browsers.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mapsvg","other","web-frontend","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `mapsvg-lite-interactive-vector-maps` plugin is installed and its version is `9.0.4` or lower","fix":"- Move to a version above `9.0.4` (the first fixed version is not stated in the sources)","status":"open","published_at":"2026-11-13T15:17:41+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","triaged_at":"2026-11-13T15:49:01+00:00","updated_at":"2026-11-13T15:49:01+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-13T15:49:01Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version above `9.0.4` (the first fixed version is not stated in the sources)","reach":"internet","title":"MapSVG WordPress plugin: stored script injection through web page content","impact":"medium","summary":"MapSVG (mapsvg-lite-interactive-vector-maps) fails to neutralize script-related HTML tags on a web page, a basic cross-site scripting flaw. An attacker who can supply content to the page can run scripts in visitors' browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","mapsvg","web-frontend"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers on the affected site","analyst_note":"Confirm the affected product (WordPress plugin on wordpress.org), the fixed version and the required privilege from the vendor or NVD entry.","how_to_check":"- Check whether the `mapsvg-lite-interactive-vector-maps` plugin is installed and its version is `9.0.4` or lower\n- unknown for other checks","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the MapSVG interactive vector maps plugin through version 9.0.4. The sources do not say what input is injected or who can supply it, so whether a site is reachable by an unprivileged visitor is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4569,"output_tokens":542,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125821':13A,16A '-2026':12A,15A '9.0.4':100C 'affect':95C 'allow':91C 'attack':50B 'basic':43B,76C 'browser':63B 'code':92C 'content':10A,54B 'cross':45B 'cross-sit':44B 'cve':11A,14A 'fail':30B 'flaw':48B 'frontend':21B 'html':36B,70C 'improp':64C 'inject':6A 'injection.this':93C 'interact':27B,88C 'issu':94C 'light':82C 'lite':26B,87C 'map':29B,90C 'mapsvg':1A,17B,23B,25B,84C,86C,96C 'mapsvg-lite-interactive-vector-map':24B,85C 'n/a':98C 'neutral':32B,65C 'norther':81C 'page':9A,41B,57B,75C 'plugin':3A 'product':83C 'pt':80C 'relat':35B,69C 'run':59B 'script':5A,34B,47B,60B,68C 'script-rel':33B,67C 'site':46B 'store':4A 'suppli':53B 'tag':37B,71C 'vector':28B,89C 'visitor':62B 'vulner':78C 'web':8A,20B,40B,74C 'web-frontend':19B 'wordpress':2A,22B 'xss':77C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MapSVG interactive vector maps plugin through version 9.0.4. The sources do not say what input is injected or who can supply it, so whether a site is reachable by an unprivileged visitor is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["mapsvg","medium","other","webfrontend","wordpress"],"campaign_type":null,"search_a":"'-125821':13A,16A '-2026':12A,15A 'content':10A 'cve':11A,14A 'inject':6A 'mapsvg':1A 'page':9A 'plugin':3A 'script':5A 'store':4A 'web':8A 'wordpress':2A","search_b":"'attack':50B 'basic':43B 'browser':63B 'content':54B 'cross':45B 'cross-sit':44B 'fail':30B 'flaw':48B 'frontend':21B 'html':36B 'interact':27B 'lite':26B 'map':29B 'mapsvg':17B,23B,25B 'mapsvg-lite-interactive-vector-map':24B 'neutral':32B 'page':41B,57B 'relat':35B 'run':59B 'script':34B,47B,60B 'script-rel':33B 'site':46B 'suppli':53B 'tag':37B 'vector':28B 'visitor':62B 'web':20B,40B 'web-frontend':19B 'wordpress':22B","search_c":"'9.0.4':100C 'affect':95C 'allow':91C 'basic':76C 'code':92C 'html':70C 'improp':64C 'injection.this':93C 'interact':88C 'issu':94C 'light':82C 'lite':87C 'map':90C 'mapsvg':84C,86C,96C 'mapsvg-lite-interactive-vector-map':85C 'n/a':98C 'neutral':65C 'norther':81C 'page':75C 'product':83C 'pt':80C 'relat':69C 'script':68C 'script-rel':67C 'tag':71C 'vector':89C 'vulner':78C 'web':74C 'xss':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125821","severity":null,"published_at":"2026-11-13T15:17:41+00:00","modified_at":"2026-11-13T15:17:41+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","fetched_at":"2026-11-13T15:46:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}