MapSVG – Vector maps, Image maps, Google Maps

MapSVG – Vector maps, Image maps, Google Maps has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; all 14 are fixed as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 6 high. 2026 was the busiest year with 7 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (29%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type, SQL Injection.

Every one of the 14 issues recorded for MapSVG – Vector maps, Image maps, Google Maps has a vendor fix available, so running the current release closes all known holes.

10 independent researchers contributed these findings, most of them (3) reported by Nguyễn Trung Kiên. MapSVG – Vector maps, Image maps, Google Maps is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

01234567891014.03.2016Today08.01.20196.1MapSVG Lite < 3.3.0 - Cross-Site Request Forgery CVSS 6.1 · 08.01.201909.04.20256.4MapSVG Lite <= 8.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 09.04.20254.3MapSVG Lite <= 8.6.4 - Missing Authorization CVSS 4.3 · 09.04.202515.04.20258.8MapSVG Lite <= 8.6.4 - Authenticated (Contributor+) Arbitrary File Upload CVSS 8.8 · 15.04.202516.05.20256.5MapSVG Lite <= 8.6.9 - Unauthenticated Arbitrary Shortcode Execution CVSS 6.5 · 16.05.202506.10.20256.4MapSVG <= 8.7.23 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 06.10.202524.12.20258.8MapSVG <= 8.7.3 - Authenticated (Contributor+) Arbitrary File Upload CVSS 8.8 · 24.12.202520.07.20267.2MapSVG <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint CVSS 7.2 · 20.07.202622.07.20266.5MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Contributor+) SQL Injection CVSS 6.5 · 22.07.20267.2MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Admin+) Arbitrary File Upload CVSS 7.2 · 22.07.20266.4MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 22.07.202623.07.20267.5MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Unauthenticated SQL Injection CVSS 7.5 · 23.07.20266.4MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 23.07.202631.08.20267.2MapSVG – Vector maps, Image maps, Google Maps <= 8.15.0 - Unauthenticated Server-Side Request Forgery CVSS 7.2 · 31.08.2026

Strategic Overview

Avg CVSSMedium
6.8/ 10
Patch Coverage100%
Open

0

Fixed

14

Get automatic notifications for all MapSVG – Vector maps, Image maps, Google Maps vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-68562

MapSVG <= 8.7.3 - Authenticated (Contributor+) Arbitrary File Upload

Read the full analysis

Vulnerability Records

14 records
2026-08-31 08:33CVE-2026-82852
7.2
High
Adam KahlonYes
2026-07-23 14:29CVE-2025-9205
6.4
Medium
zer0gh0stYes
2026-07-23 00:00CVE-2026-59527
7.5
High
Trương Hữu Phúc (truonghuuphuc)Yes
2026-07-22 00:00CVE-2026-65450
6.5
Medium
Trương Hữu Phúc (truonghuuphuc)Yes
2026-07-22 00:00CVE-2026-65455
7.2
High
Securepeak Research TeamYes
2026-07-22 00:00CVE-2026-65449
6.4
Medium
johskaYes
2026-07-20 19:29CVE-2026-1771
7.2
High
san6051Yes
2025-12-24 00:00CVE-2025-68562
8.8
High
stealthcopterYes
2025-10-06 00:00CVE-2025-62930
6.4
Medium
Gilang Asra Bilhadi - DJYes
2025-05-16 00:00CVE-2025-48120
6.5
Medium
Trương Hữu Phúc (truonghuuphuc)Yes
Showing 1–10 of 14 reports
MapSVG – Vector maps, Image maps, Google Maps banner
Latestv8.16.1

MapSVG – Vector maps, Image maps, Google Maps

RomanCode

Author

RomanCode

4.5(31)
90/100
Last Updated
2026-09-09 (4d ago)
Active Installs
1,000+
Downloads
73,034
Requires WP
5.0+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2016-03-14 (11y ago)

MapSVG is a powerful WordPress mapping plugin that allows you to create interactive vector maps, floor plans, and image maps. Perfect for real estate websites, store locators, seating charts, and more. WP-Admin Demo Key Features (free version) SVG Vector Maps (100+ maps are included in the plugin) Custom SVG files support (upload your own SVG files and turn them into interactive maps) Google Maps Custom overlays on Google Maps Image Maps Floor Plans Store Locator (search by address) Markers (add markers by entering an address) Connect markers to clickable areas on the map (show all locations connected to a specific area in the popover window) Map areas and markers working as links Custom Tooltips, Popovers, Large scrollable modals Database Integration Custom Fields Filters & Search REST API Support MapSVG vs other mapping plugin Below is the comparison of the free version of MapSVG to other popular free mapping plugins on WordPress.org. Unlimited maps MapSVG: Unlimited number of maps Others: 1 map Unlimited locations MapSVG: Unlimited number of markers Others: Limited number of markers Map regions to locations connection MapSVG: Connect markers to map clickable areas. Every area of the map can have one or many markers connected to it. Show the list of connected locations in the popover window. Others: No connection between markers and map clickable areas Internal Database MapSVG: Custom database, with custom fields support Others: You can only use a small set of pre-defined fields, such as title, description and address. Views MapSVG: Show custom fields, as formatted HTML, or show the fully rendered WP Post content – in the Tooltips / Popovers (unique feature of MapSVG) Others: You can only show the coordinates of the marker in a small tooltip Labels MapSVG: Show marker labels (name or address of the location) and region labels (names of countries, states, etc.) Others: No labels MapSVG Premium Features Directory: Display a list of interactive items alongside the map. Custom Overlays: Add custom overlays on Google Maps. Advanced Filters: Enable fulltext search, search by category, zip code, by date. Country-Specific Address Search: Restrict address searches by country. CSV Data Import: Load data seamlessly from CSV files. Image Gallery Module: Showcase images in a lightbox format. Parent/Child Maps: Open an additional map upon clicking a region. Marker Clustering: Group large amount of markers into clusters. Data Source: WordPressCPT: Use WordPress CPTs as a data source. Data Source: Custom API: Use JSON response from your own API as a data source. Code editor: CSS: Edit CSS directly in the map editor, customize the look and feel of the map. Code editor: Handlebars Templates: Get full control over the HTML of the popovers / tooltips / details view. Code editor: JavaScript: Use built-in JavaScript editor for event handling, middleware customization, modify data before it is displayed on the map. Custom Marker Images: Upload your own marker images. Chat Authorization: Store the chat history. Get access to the same chats online any time on mapsvg.com/dashboard. Priority Support: Faster response time in the chat. Purchase Code for Updates: Enable automatic updates from our servers with the purchase code for more frequent updates. One-Click wp-admin Access: Grant support agents quick access to your wp-admin for faster issue resolution.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C