CVE-2019-1000003

PoC —

CVSS 3.0

8.8 high

EPSS

<1%p54

Published

Feb 4, 2019 (Feb 4, 2019)

Modified

Jun 17, 2026

Description

MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be logged in to WordPress as an admin, and click a link. This vulnerability appears to have been fixed in 3.3.0 and later.

Vendors: mapsvg
Products: mapsvg lite
Ecosystems: WordPress
Weakness: CWE-352
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.