RomanCode MapSVG vulnerabilities

Latest RomanCode MapSVG CVEs

Newest publication first

1. CVE-2026-59527 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

   Published 2026-07-27

   Critical·CVSS 9.3 EPSS 0.40%

   Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.

2. CVE-2026-65451 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

   Published 2026-07-23

   High·CVSS 8.5 EPSS 0.36%

   Contributor SQL Injection in MapSVG <= 8.14.0 versions.

3. CVE-2026-65449 WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability

   Published 2026-07-23

   Medium·CVSS 6.5 EPSS 0.22%

   Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.

4. CVE-2026-65450 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

   Published 2026-07-23

   High·CVSS 8.5 EPSS 0.36%

   Contributor SQL Injection in MapSVG <= 8.14.0 versions.

5. CVE-2026-59526 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

   Published 2026-07-23

   Critical·CVSS 9.3 EPSS 0.40%

   Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.

6. CVE-2025-68562 WordPress MapSVG plugin <= 8.7.3 - Arbitrary File Upload vulnerability

   Published 2025-12-29

   Critical·CVSS 9.9 EPSS 0.42%

   Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.7.3.

7. CVE-2025-54748 WordPress MapSVG Plugin < 8.6.12 - Arbitrary File Download Vulnerability

   Published 2025-12-18

   Medium·CVSS 6.5 EPSS 0.39%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RomanCode MapSVG mapsvg allows Path Traversal.This issue affects MapSVG: from n/a through < 8.6.12.

8. CVE-2025-62930 WordPress MapSVG plugin <= 8.7.22 - Cross Site Scripting (XSS) vulnerability

   Published 2025-10-27

   Medium·CVSS 6.5 EPSS 0.20%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows DOM-Based XSS.This issue affects MapSVG: from n/a through <= 8.7.22.

9. CVE-2025-54669 WordPress MapSVG Plugin < 8.7.4 - SQL Injection Vulnerability

   Published 2025-08-14

   Critical·CVSS 9.3 EPSS 0.33%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RomanCode MapSVG mapsvg allows SQL Injection.This issue affects MapSVG: from n/a through < 8.7.4.

10. CVE-2025-47559 WordPress MapSVG plugin < 8.7.4 - Arbitrary File Upload vulnerability

    Published 2025-06-17

    Critical·CVSS 9.9 EPSS 0.55%

    Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through < 8.7.4.

11. CVE-2025-47561 WordPress MapSVG plugin < 8.6.13 - Privilege Escalation Vulnerability

    Published 2025-06-09

    High·CVSS 8.8 EPSS 0.36%

    Incorrect Privilege Assignment vulnerability in RomanCode MapSVG mapsvg allows Privilege Escalation.This issue affects MapSVG: from n/a through < 8.6.13.

12. CVE-2025-47558 WordPress MapSVG plugin < 8.6.13 - Broken Access Control vulnerability

    Published 2025-05-23

    High·CVSS 7.5 EPSS 0.45%

    Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MapSVG: from n/a through < 8.6.13.

13. CVE-2025-47560 WordPress MapSVG plugin < 8.6.13 - Broken Access Control Vulnerability

    Published 2025-05-16

    Medium·CVSS 5.0 EPSS 0.31%

    Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through < 8.6.13.

14. CVE-2025-47557 WordPress MapSVG plugin <= 8.5.31 - Cross Site Scripting (XSS) vulnerability

    Published 2025-05-16

    Medium·CVSS 6.5 EPSS 0.26%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg allows Stored XSS.This issue affects MapSVG: from n/a through <= 8.5.31.

15. CVE-2025-47562 WordPress MapSVG plugin <= 8.5.34 - Content Injection Vulnerability

    Published 2025-05-16

    Medium·CVSS 5.3 EPSS 0.36%

    Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg allows Code Injection.This issue affects MapSVG: from n/a through <= 8.5.34.

16. CVE-2025-48120 WordPress MapSVG Lite plugin <= 8.6.9 - Arbitrary Shortcode Execution vulnerability

    Published 2025-05-16

    Medium·CVSS 5.3 EPSS 0.30%

    Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue affects MapSVG: from n/a through <= 8.6.9.

17. CVE-2025-32682 WordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload Vulnerability

    Published 2025-04-17

    Critical·CVSS 9.9 EPSS 0.59%

    Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through <= 8.6.4.

18. CVE-2025-32683 WordPress MapSVG Lite plugin <= 8.6.6 - Cross Site Scripting (XSS) Vulnerability

    Published 2025-04-09

    Medium·CVSS 6.5 EPSS 0.30%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows DOM-Based XSS.This issue affects MapSVG: from n/a through <= 8.6.6.

19. CVE-2025-32684 WordPress MapSVG Lite plugin <= 8.6.4 - Broken Access Control Vulnerability

    Published 2025-04-09

    Medium·CVSS 5.0 EPSS 0.38%

    Missing Authorization vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through <= 8.6.4.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.