What’s Vulnerable › Vulnerabilities

CVE-2022-0592: MapSVG < 6.2.20 - Unauthenticated SQLi

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-05-09 · updated 2026-06-17
• Weakness: CWE-89

Description

The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users.

Affected products

• MapSVG: before 6.2.20 — fixed in 6.2.20

How to fix

Upgrade to a fixed version: MapSVG 6.2.20. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/5d8d53ad-dc88-4b50-a292-fc447484c27b
• https://wpscan.com/vulnerability/5d8d53ad-dc88-4b50-a292-fc447484c27b

Get alerted when CVE-2022-0592 or the next vulnerability affects your stack