Read the docs
TI-2012-05441 Aliases CVE-2012-10018GHSA-v3rv-7532-9gg6

Mapplic Lite and Mapplic <= (Various Versions) - Server Side Request Forgery to Cross-Site Scirpting

Priority HIGH 75CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively. This makes it possible for attackers to forgery requests coming from a vulnerable site's server and ultimately perform an XSS attack if requesting an SVG file.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01181 67th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Mapplic Lite (sekler): 1.0.1Mapplic - Custom Interactive Map WordPress Plugin (sekler): 6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
seklerMapplic Litebefore 1.0.11.0.1Patch availableCNA
seklerMapplic - Custom Interactive Map WordPress Pluginbefore 6.26.2Patch availableCNA
  • Mapplic Lite Vendorsekler Affected before 1.0.1 Fixed in 1.0.1 Patch available CNA
  • Mapplic - Custom Interactive Map WordPress Plugin Vendorsekler Affected before 6.2 Fixed in 6.2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mapplic:mapplic:*:*:*:*:lite:wordpress:*:*up to 1.0VulnerableMapplic
cpe:2.3:a:mapplic:mapplic:*:*:*:*:-:wordpress:*:*up to 6.1VulnerableMapplic
  • cpe:2.3:a:mapplic:mapplic:*:*:*:*:lite:wordpress:*:* Versions up to 1.0 Vulnerable ·Mapplic
  • cpe:2.3:a:mapplic:mapplic:*:*:*:*:-:wordpress:*:* Versions up to 6.1 Vulnerable ·Mapplic

Remediation

  • Fix · CNA Mapplic Lite (sekler) Fixed in 1.0.1
  • Fix · CNA Mapplic - Custom Interactive Map WordPress Plugin (sekler) Fixed in 6.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-10018
  2. 2026-10-03 Alias added: GHSA-v3rv-7532-9gg6

References

Exploit 2

Patch 1

Advisory 1

Other 1

  • TI-2024-08467 Mapplic Lite <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CVSS 3.1MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences