The MapSVG plugin for WordPress is vulnerable to improper code generation, allowing an attacker to inject arbitrary code via unsanitized content. This flaw is classified as a Code Injection weakness (CWE‑94). If exploited, it could enable an attacker to inject malicious scripts into the site, potentially leading to cross‑site scripting, theft of user data, or remote code execution depending on the context of the injected code.

Vendors: RomanCode. Product: MapSVG plugin for WordPress. Versions affected: any installation of mapsvg from the earliest released version up to and including 8.5.34.

The CVSS base score is 5.3, indicating moderate severity. The EPSS score of less than 1% suggests that exploitation in the wild is unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. Because the description does not specify an authenticated or unauthenticated path, it is inferred that the attack may require legitimate user access within the WordPress admin area or a page that renders plugin content; absent additional data, the attack vector remains uncertain.