Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

WordPress MapSVG plugin <= 8.14.0 - Attackers can access data

CVE-2026-59526 · published 3 months ago
Summary

An outdated version of the MapSVG plugin in WordPress makes it possible for attackers to inject malicious code and access sensitive data. This is a serious security risk that needs to be addressed by updating the plugin to a version higher than 8.14.0.

What to do
  • Update romancode mapsvg to version 8.14.1.
Affected software
VendorProductAffected versions
romancode mapsvg <= 8.14.0
Fix: upgrade to 8.14.1
Original advisory text
Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published23 Jul 2026
Updated4 Nov 2026
First seen23 Jul 2026
Sources
CVE-2026-59526 · NVD
CVE-2026-59526 · MITRE
Track software like this
Free during beta