blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2019-1000003

HIGH 8.8 CVSS 3.0
Published
February 4, 2019
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-352
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be logged in to WordPress as an admin, and click a link. This vulnerability appears to have been fixed in 3.3.0 and later.

Affected products and versions

  • n/a n/a — Versions not specified

References

  • advisories.dxw.com https://advisories.dxw.com/advisories/csrf-mapsvg-lite/ Third Party Advisory
  • wpvulndb.com https://wpvulndb.com/vulnerabilities/9198 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record