Improper neutralization of input during web page generation in the MapSVG plugin allows attackers to store malicious script code in map data. When a page containing that data is rendered, the injected script executes in the victim’s browser, potentially leading to defacement, credential theft, or further session hijacking. The flaw is a classic stored XSS weakness (CWE‑79).

The vulnerability affects WordPress sites that have the MapSVG "mapsvg-lite‑interactive‑vector‑maps" plugin installed. Versions from the earliest available release up through 8.16.1 are vulnerable, regardless of the site’s WordPress core version.

The CVSS score of 6.5 indicates a moderate severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, so there is no known large‑scale exploitation activity yet. An attacker would likely need the ability to submit or modify map content – typically through an editor or administrator account – to inject the payload. Once stored, the script runs for all visitors, creating a widespread impact unless countermeasures are applied.