oyatek vulnerabilities and threats

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The MapSVG plugin for WordPress contains an improper input validation vulnerability in the SVGFile constructor that affects all versions up to and including 8.14.0. This flaw allows authenticated users with Administrator-level access or higher to upload arbitrary files due to missing file type validation. Exploitation of this vulnerability could lead to remote code execution on the affected server. The vulnerability has a high severity rating with a CVSS score of 7.2. No official patch or remediation guidance has been provided at this time.