[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_YBnlkQMAkarSxa1SVWmFOnphwWBmUA5uxgg1uUWHHY":3,"$fO-tCTxMnpNxhpygbhiu7rv0B8OsoBqRnTdh43tVvwlw":315,"$fJrWMjkKkYxY1FA-CQse_AfmJsIe9LfA1CHeMfqeM0HQ":319},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":11,"num_ratings":11,"last_updated":13,"tested_up_to":14,"requires_at_least":15,"requires_php":16,"tags":17,"homepage":22,"download_link":23,"security_score":24,"vuln_count":25,"unpatched_count":25,"last_vuln_date":26,"fetched_at":27,"discovery_status":28,"vulnerabilities":29,"developer":56,"crawl_stats":35,"alternatives":62,"analysis":161,"fingerprints":284},"svg-map-by-saedi","SVG Map by Smjrifle","1.0.3","smjrifle","https:\u002F\u002Fprofiles.wordpress.org\u002Fsmjrifle\u002F","\u003Cp>SVG Map by Smjrifle allows you to display an interactive SVG map with clickable points.\u003C\u002Fp>\n\u003Cp>Administrators can select points from the map and assign popup descriptions that appear on hover.\u003C\u002Fp>\n\u003Cp>Originally developed under Saedi Works, this plugin is now independently maintained and actively improved by Smjrifle.\u003C\u002Fp>\n\u003Cp>Features include:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Interactive SVG map\u003C\u002Fli>\n\u003Cli>Clickable location points\u003C\u002Fli>\n\u003Cli>Admin-managed popup descriptions\u003C\u002Fli>\n\u003Cli>Popup descriptions on hover\u003C\u002Fli>\n\u003Cli>Shortcode integration\u003C\u002Fli>\n\u003Cli>Secure AJAX handling\u003C\u002Fli>\n\u003Cli>Security hardened architecture\u003C\u002Fli>\n\u003C\u002Ful>\n","Add an interactive SVG world map with selectable points and popup descriptions.",0,1405,"2026-04-04T04:13:00.000Z","6.9.5","5.8","8.0",[18,19,20,21],"interactive","locations","map","svg","https:\u002F\u002Fsmjrifle.net","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsvg-map-by-saedi.1.0.3.zip",78,1,"2026-01-06 19:40:29","2026-07-22T17:31:50.256Z","no_bundle",[30],{"id":31,"url_slug":32,"title":33,"description":34,"plugin_slug":4,"theme_slug":35,"affected_versions":36,"patched_in_version":35,"severity":37,"cvss_score":38,"cvss_vector":39,"vuln_type":40,"published_date":26,"updated_date":41,"references":42,"days_to_patch":35,"patch_diff_files":44,"patch_trac_url":35,"research_status":45,"research_verified":46,"research_rounds_completed":47,"research_plan":48,"research_summary":49,"research_vulnerable_code":50,"research_fix_diff":51,"research_exploit_outline":52,"research_model_used":53,"research_started_at":54,"research_completed_at":55,"research_error":35,"poc_status":35,"poc_video_id":35,"poc_summary":35,"poc_steps":35,"poc_tested_at":35,"poc_wp_version":35,"poc_php_version":35,"poc_playwright_script":35,"poc_exploit_code":35,"poc_has_trace":46,"poc_model_used":35,"poc_verification_depth":35},"CVE-2025-13519","svg-map-plugin-cross-site-request-forgery-to-settings-update-and-stored-cross-site-scripting","SVG Map Plugin \u003C= 1.0.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting","The SVG Map Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on multiple AJAX actions including 'save_data', 'delete_data', and 'add_popup'. This makes it possible for unauthenticated attackers to update the plugin's settings, delete map data, and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",null,"\u003C=1.0.0","medium",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Cross-Site Request Forgery (CSRF)","2026-04-15 16:18:30",[43],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F5aaa97cc-4deb-43b6-957d-587834eca125?source=api-prod",[],"researched",false,3,"# Exploitation Research Plan: CVE-2025-13519 (SVG Map Plugin)\n\n## 1. Vulnerability Summary\nThe **SVG Map by Smjrifle** plugin (versions up to 1.0.0) is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS). Multiple AJAX actions, specifically `save_data`, `delete_data`, and `add_popup`, fail to implement proper nonce validation (or use incorrect validation logic). This allows an attacker to trick a logged-in administrator into making unintended requests that modify map settings, delete data, or inject malicious JavaScript into the map configuration.\n\n## 2. Attack Vector Analysis\n*   **Endpoints:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **AJAX Actions:** `save_data` (Primary for XSS), `delete_data`, `add_popup`.\n*   **HTTP Method:** POST\n*   **Authentication:** Requires a logged-in Administrator session (targeted via CSRF).\n*   **Payload Parameter:** Likely a JSON string or specific POST fields representing map data (e.g., `data`, `content`, or `popup_text`).\n*   **Preconditions:** An administrator must be tricked into visiting an attacker-controlled page while authenticated.\n\n## 3. Code Flow (Inferred)\n1.  **Entry Point:** The plugin registers AJAX handlers using `add_action('wp_ajax_save_data', ...)` and `add_action('wp_ajax_add_popup', ...)`.\n2.  **Missing Check:** Inside the callback functions for these actions, there is either no call to `check_ajax_referer()` or `wp_verify_nonce()`, or the check is incorrectly implemented (e.g., ignoring the return value).\n3.  **Data Processing:** The handler retrieves user input from `$_POST`.\n4.  **Database Sink:** The input is stored in the database via `update_option()` or `$wpdb->insert()\u002Fupdate()`.\n5.  **Output (XSS):** When the SVG map is rendered on the frontend or admin dashboard, the unsanitized input is printed directly into the HTML, executing the injected script.\n\n## 4. Nonce Acquisition Strategy\nThe vulnerability description states \"missing or incorrect nonce validation.\" If validation is truly missing, no nonce is required. However, if the agent needs to verify an \"incorrect\" implementation or if the plugin *attempts* to use a nonce but fails to verify it properly:\n\n1.  **Identify Script Localization:** Search the source for `wp_localize_script`.\n2.  **Create Trigger Page:** Create a page with the map shortcode (inferred to be `[svg-map]` or similar based on plugin slug).\n    ```bash\n    wp post create --post_type=page --post_status=publish --post_title=\"Map Test\" --post_content='[svg-map]'\n    ```\n3.  **Extract Nonce via Browser:**\n    *   Navigate to the created page using `browser_navigate`.\n    *   Use `browser_eval` to find potential nonce objects:\n        ```javascript\n        \u002F\u002F Inferred variable names based on common plugin patterns\n        window.svg_map_obj?.nonce || window.smjrifle_map_data?.security\n        ```\n4.  **Source Check:** If source is available, grep for the action used in `wp_create_nonce` to ensure the correct string is used in the exploit.\n\n## 5. Exploitation Strategy\nWe will target the `save_data` action to inject a Stored XSS payload via CSRF.\n\n### Step 1: Craft the CSRF Request\nThe request will be a POST to `admin-ajax.php`.\n\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Method:** POST\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:**\n    ```\n    action=save_data&data={\"id\":\"1\",\"title\":\"\u003Cscript>alert(origin)\u003C\u002Fscript>\",\"other_params\":\"...\"}\n    ```\n    *(Note: The exact structure of the `data` parameter needs to be verified by looking at the plugin's JS or PHP handler.)*\n\n### Step 2: Execute via Agent\nSince the agent simulates the \"attacker\" and \"victim\" roles in an isolated environment, it can perform the request using the administrator's cookies directly to demonstrate the lack of CSRF protection.\n\n```javascript\n\u002F\u002F Using http_request tool\nconst response = await http_request({\n  url: \"http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php\",\n  method: \"POST\",\n  form: {\n    action: \"save_data\",\n    data: '{\"title\":\"\u003Cscript>alert(\\'XSS\\')\u003C\u002Fscript>\"}' \u002F\u002F Payload\n  }\n});\n```\n\n## 6. Test Data Setup\n1.  **Active Plugin:** Ensure `svg-map-by-saedi` is installed and activated.\n2.  **Create Map Instance:** If the plugin requires an existing map ID, create one through the admin UI or via `wp eval`.\n3.  **Administrator User:** Use the existing admin account to perform the authenticated request.\n\n## 7. Expected Results\n*   **HTTP Response:** A successful JSON response (e.g., `{\"success\":true}` or `1`) despite no nonce being provided.\n*   **Database Change:** The malicious `\u003Cscript>` tag is stored in the plugin's configuration options or database tables.\n*   **XSS Execution:** Navigating to the page where the map is displayed triggers a JavaScript alert.\n\n## 8. Verification Steps\n1.  **Check Database:**\n    ```bash\n    wp option get svg_map_data --format=json\n    # OR if it uses a custom table\n    wp db query \"SELECT * FROM wp_svg_maps\"\n    ```\n2.  **Frontend Check:**\n    Navigate to the page containing the map and check for the presence of the payload:\n    ```javascript\n    browser_eval(\"document.body.innerHTML.includes('\u003Cscript>alert')\")\n    ```\n\n## 9. Alternative Approaches\n*   **Target `add_popup`:** If `save_data` is well-sanitized, try the `add_popup` action. Popups often involve HTML content and are frequently overlooked during sanitization.\n    *   **Payload:** `action=add_popup&map_id=1&content=\u003Cimg src=x onerror=alert(1)>`\n*   **Target `delete_data`:** To demonstrate CSRF without XSS, attempt to delete all map data by sending a request to `delete_data` without a nonce. Success confirms the CSRF vulnerability.","The SVG Map Plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) because it lacks nonce validation on multiple AJAX actions like 'save_data', 'delete_data', and 'add_popup'. This allows attackers to trick an administrator into executing unintended requests that can modify map settings, delete data, or inject malicious JavaScript (Stored XSS) into map configurations.","\u002F\u002F Inferred from plugin slug: svg-map-by-saedi\n\nadd_action('wp_ajax_save_data', 'smjrifle_save_data_callback');\nadd_action('wp_ajax_add_popup', 'smjrifle_add_popup_callback');\nadd_action('wp_ajax_delete_data', 'smjrifle_delete_data_callback');\n\nfunction smjrifle_save_data_callback() {\n    \u002F\u002F Vulnerability: No check_ajax_referer() or wp_verify_nonce() call\n    if (isset($_POST['data'])) {\n        $data = $_POST['data']; \u002F\u002F Often processed as JSON or raw string\n        update_option('svg_map_data', $data);\n        echo json_encode(['success' => true]);\n    }\n    wp_die();\n}\n\n---\n\nfunction smjrifle_add_popup_callback() {\n    \u002F\u002F Vulnerability: No check_ajax_referer() or wp_verify_nonce() call\n    global $wpdb;\n    if (isset($_POST['content'])) {\n        $content = $_POST['content']; \u002F\u002F Unsanitized input leading to Stored XSS\n        $wpdb->insert($wpdb->prefix . 'svg_map_popups', ['content' => $content]);\n    }\n    wp_die();\n}","--- a\u002Fsvg-map-by-saedi.php\n+++ b\u002Fsvg-map-by-saedi.php\n@@ -10,6 +10,7 @@\n function smjrifle_save_data_callback() {\n+    check_ajax_referer('svg_map_nonce_action', 'security');\n     if (isset($_POST['data'])) {\n-        $data = $_POST['data'];\n+        $data = sanitize_text_field($_POST['data']);\n         update_option('svg_map_data', $data);\n@@ -20,6 +21,7 @@\n function smjrifle_add_popup_callback() {\n+    check_ajax_referer('svg_map_nonce_action', 'security');\n     global $wpdb;\n     if (isset($_POST['content'])) {\n-        $content = $_POST['content'];\n+        $content = wp_kses_post($_POST['content']);\n         $wpdb->insert($wpdb->prefix . 'svg_map_popups', ['content' => $content]);","The exploit targets the `\u002Fwp-admin\u002Fadmin-ajax.php` endpoint via a CSRF attack. An attacker crafts a malicious HTML page containing a form that automatically submits a POST request to the target site. The payload includes the 'action' parameter set to 'save_data' or 'add_popup', and a 'data' or 'content' parameter containing a Stored XSS payload (e.g., \u003Cscript>alert(1)\u003C\u002Fscript>). Because the plugin does not verify a CSRF nonce, the request is processed using the authenticated session of a site administrator who views the attacker's page. Once stored, the malicious script executes whenever a user or admin views the affected map or popup in the WordPress dashboard or on the frontend.","gemini-3-flash-preview","2026-05-21 02:23:47","2026-05-21 02:24:20",{"slug":7,"display_name":7,"profile_url":8,"plugin_count":47,"total_installs":57,"avg_security_score":58,"avg_patch_time_days":59,"trust_score":60,"computed_at":61},10,93,30,89,"2026-08-29T16:37:12.115Z",[63,88,108,125,144],{"slug":64,"name":65,"version":66,"author":67,"author_profile":68,"description":69,"short_description":70,"active_installs":71,"downloaded":72,"rating":73,"num_ratings":74,"last_updated":75,"tested_up_to":76,"requires_at_least":77,"requires_php":78,"tags":79,"homepage":84,"download_link":85,"security_score":86,"vuln_count":47,"unpatched_count":11,"last_vuln_date":87,"fetched_at":27},"interactive-world-map","Interactive World Map","3.5.1","html5maps","https:\u002F\u002Fprofiles.wordpress.org\u002Fhtml5maps\u002F","\u003Cp>Put a free high-quality Interactive World Map to your WordPress powered website!\u003C\u002Fp>\n\u003Cp>Try our \u003Ca href=\"https:\u002F\u002Fwww.fla-shop.com\u002Fproducts\u002Fwp-plugins\u002Fworld\u002Fcountries\u002F\" rel=\"nofollow ugc\">\u003Cstrong>World map plugin with clickable countries\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>Whenever you need to give your visitors a simple yet effective way to navigate through regional sections of your site, or if you want to provide some geography-related information to your visitors, Fla-shop.com interactive HTML5 map plugin is a one-stop solution. The plugin allows you to display a World map by merely adding a shortcode into the main content of a page or a post. Thanks to the visual editing of the map’s properties and effortless installation, the map can be deployed in mere minutes.\u003C\u002Fp>\n\u003Cp>Features:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Interactive map of the World\u003C\u002Fli>\n\u003Cli>Responsive and mobile-friendly\u003C\u002Fli>\n\u003Cli>SVG based\u003C\u002Fli>\n\u003Cli>Works on iOS\u002FAndroid devices\u003C\u002Fli>\n\u003Cli>Popup windows that show when the mouse cursor is over it\u003C\u002Fli>\n\u003Cli>Customizable landing page links\u003C\u002Fli>\n\u003Cli>Easy embedding by a shortcode\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Additional features of the \u003Ca href=\"https:\u002F\u002Fwww.fla-shop.com\u002Fproducts\u002Fwp-plugins\u002Fworld\u002Fcountries\u002F\" rel=\"nofollow ugc\">Premium World Map\u003C\u002Fa>:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Map of the World with clickable countries\u003C\u002Fli>\n\u003Cli>The ability to add markers to the map\u003C\u002Fli>\n\u003Cli>Function to set up your own regions\u003C\u002Fli>\n\u003Cli>Integration with Popup Builder to display lightbox popups\u003C\u002Fli>\n\u003Cli>Color customizing, smooth change color\u003C\u002Fli>\n\u003Cli>No brand link\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>The plugin allows you to create an unlimited number of clickable world maps with different settings – colors, links, pop-ups, etc.\u003Cbr \u002F>\nThe plugin is compatible with any WordPress theme, including the popular Divi and Avada themes. The map can be inserted in any page builder such as Elementor, Gutenberg, Visual Composer, etc.\u003C\u002Fp>\n\u003Cp>The plugin Interactive World Map is based on and uses cdn-hosted map library.\u003Cbr \u002F>\nThe free version of the map display the “Map by Fla-shop.com” link as required by the license agreement found \u003Ca href=\"https:\u002F\u002Fwww.fla-shop.com\u002Ffree_stuff.php#terms\" rel=\"nofollow ugc\">here\u003C\u002Fa>.\u003Cbr \u002F>\nAll premium plugins are branding free and additionally included all required map libraries to put on your server.\u003C\u002Fp>\n","Free plugin for WordPress displays an interactive map of the World. The map features customized colors, links and popup balloons.",1000,79657,70,17,"2026-05-28T15:07:00.000Z","7.0.2","3.3","",[80,81,64,82,83],"clickable-map","interactive-map","svg-map","world-map","https:\u002F\u002Ffla-shop.com","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Finteractive-world-map.zip",98,"2024-10-24 00:00:00",{"slug":89,"name":90,"version":91,"author":92,"author_profile":93,"description":94,"short_description":95,"active_installs":96,"downloaded":97,"rating":11,"num_ratings":11,"last_updated":98,"tested_up_to":99,"requires_at_least":100,"requires_php":78,"tags":101,"homepage":105,"download_link":106,"security_score":107,"vuln_count":11,"unpatched_count":11,"last_vuln_date":35,"fetched_at":27},"interactive-svg-map","Interactive SVG Map","3.0.0","Yogesh Pawar","https:\u002F\u002Fprofiles.wordpress.org\u002Fpawaryogesh1989\u002F","\u003Cp>This Plugin is based on Github JQV MAP.\u003C\u002Fp>\n\u003Cp>URL:  https:\u002F\u002Fgithub.com\u002Fmanifestinteractive\u002Fjqvmap\u003C\u002Fp>\n\u003Cp>This plugin displays Map in SVG format. To use this map just insert [interactive-map] shortcode in any page\u002Fpost to display the map.\u003C\u002Fp>\n\u003Ch4>Details\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Display Map in SVG format.\u003C\u002Fli>\n\u003Cli>Compatible on all major browsers and mobile devices (responsive)\u003C\u002Fli>\n\u003Cli>Configure Map options from the admin.\u003C\u002Fli>\n\u003Cli>Map display can be customized.\u003C\u002Fli>\n\u003Cli>Following Maps are available currently.\n\u003Cul>\n\u003Cli>World Map\u003C\u002Fli>\n\u003Cli>USA\u003C\u002Fli>\n\u003Cli>Europe\u003C\u002Fli>\n\u003Cli>Germany\u003C\u002Fli>\n\u003Cli>Africa\u003C\u002Fli>\n\u003Cli>Asia\u003C\u002Fli>\n\u003Cli>Australia\u003C\u002Fli>\n\u003Cli>Argentina\u003C\u002Fli>\n\u003Cli>Algeria\u003C\u002Fli>\n\u003Cli>Brazil\u003C\u002Fli>\n\u003Cli>Canada\u003C\u002Fli>\n\u003Cli>France\u003C\u002Fli>\n\u003Cli>Greece\u003C\u002Fli>\n\u003Cli>Iran\u003C\u002Fli>\n\u003Cli>Iraq\u003C\u002Fli>\n\u003Cli>North America\u003C\u002Fli>\n\u003Cli>Russia\u003C\u002Fli>\n\u003Cli>South America\u003C\u002Fli>\n\u003Cli>Tunisia\u003C\u002Fli>\n\u003Cli>Turkey\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>The map can be displayed on any page by inserting the “[interactive-map]” shortcode in any page. (without double quotes)\u003C\u002Fli>\n\u003C\u002Ful>\n","Use this plugin display map in SVG format.",40,8335,"2021-01-05T11:20:00.000Z","5.6.17","5.0",[89,82,102,103,104],"svg-map-wordpress","wordpress-map","wordpress-svg-map","http:\u002F\u002Fwww.clariontechnologies.co.in","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Finteractive-svg-map.zip",85,{"slug":109,"name":110,"version":6,"author":111,"author_profile":112,"description":113,"short_description":114,"active_installs":115,"downloaded":116,"rating":11,"num_ratings":11,"last_updated":117,"tested_up_to":14,"requires_at_least":118,"requires_php":119,"tags":120,"homepage":78,"download_link":123,"security_score":124,"vuln_count":11,"unpatched_count":11,"last_vuln_date":35,"fetched_at":27},"atlas-maps","Interactive World, Europe & US Maps – Atlas Maps","Toro Guapo","https:\u002F\u002Fprofiles.wordpress.org\u002Ftoroguapo\u002F","\u003Cp>Atlas Maps is an interactive SVG map plugin for WordPress. Build responsive \u003Cstrong>world\u003C\u002Fstrong>, \u003Cstrong>Europe\u003C\u002Fstrong> and \u003Cstrong>US\u003C\u002Fstrong> maps with clickable regions, tooltips and pins in just a few minutes. Create interactive world maps, US state maps and Europe maps for navigation, directories, store locators and more — all inside WordPress.\u003C\u002Fp>\n\u003Cp>Customize your map colors, tooltips and click actions directly in the WordPress admin with instant visual feedback, then embed your map anywhere using a simple shortcode. \u003Cstrong>No coding required\u003C\u002Fstrong> and no Google Maps or external APIs needed.\u003C\u002Fp>\n\u003Cp>\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002F6QKznNoiyww?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Ftoroguapo.com\u002Fatlas-maps\" rel=\"nofollow ugc\">View a demo\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Ftoroguapo.com\u002Fatlas-maps-pro\u002Fpricing\" rel=\"nofollow ugc\">See Pro features\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Features\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Quickly build an interactive world map with clickable countries, a US map with clickable states, or a Europe map with clickable countries for your WordPress site.\u003C\u002Fli>\n\u003Cli>Optionally show or hide Alaska and Hawaii on US maps.\u003C\u002Fli>\n\u003Cli>Create unlimited interactive maps and display them anywhere using shortcodes. No coding required.\u003C\u002Fli>\n\u003Cli>All maps use the correct projection out of the box.\u003C\u002Fli>\n\u003Cli>Maps are fully responsive and mobile-friendly.\u003C\u002Fli>\n\u003Cli>Edit maps in the WordPress admin with instant visual feedback.\u003C\u002Fli>\n\u003Cli>Choose from 3 beautiful built-in themes.\u003C\u002Fli>\n\u003Cli>Use click actions to direct users to any location when they click individual regions.\u003C\u002Fli>\n\u003Cli>Customize tooltips using dynamic fields (region name, country name, state name, etc.).\u003C\u002Fli>\n\u003Cli>Create up to 5 pins at any latitude\u002Flongitude location.\u003C\u002Fli>\n\u003Cli>Customize the pin tooltip with the same powerful formatting as region tooltips.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Pro Features\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>198 country maps\u003C\u002Fstrong> including \u003Cstrong>26 territories\u003C\u002Fstrong>, and \u003Cstrong>56 US state maps\u003C\u002Fstrong>.\u003C\u002Fli>\n\u003Cli>Rich-text and interactive tooltips (clickable content inside the tooltip).\u003C\u002Fli>\n\u003Cli>Additional themes and a full theme editor to perfectly match your site.\u003C\u002Fli>\n\u003Cli>Per-region hover effects and color customization.\u003C\u002Fli>\n\u003Cli>Unlimited pins with configurable tooltips and shapes.\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Ftoroguapo.com\u002Fatlas-maps-pro\" rel=\"nofollow ugc\">See a live demo with all Pro features enabled\u003C\u002Fa>.\u003C\u002Fli>\n\u003C\u002Ful>\n","Build interactive world, Europe & US maps with clickable regions, tooltips and pins. Responsive map plugin for WordPress, no coding required.",20,530,"2025-12-20T15:50:00.000Z","6.5","7.0",[121,81,82,122,83],"clickable-maps","us-map","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fatlas-maps.1.0.3.zip",100,{"slug":126,"name":127,"version":128,"author":129,"author_profile":130,"description":131,"short_description":132,"active_installs":115,"downloaded":133,"rating":11,"num_ratings":11,"last_updated":134,"tested_up_to":135,"requires_at_least":136,"requires_php":137,"tags":138,"homepage":78,"download_link":143,"security_score":124,"vuln_count":11,"unpatched_count":11,"last_vuln_date":35,"fetched_at":27},"interactive-map-widget","Interactive Map Widget","1.2.27","WordPress Hilfe & Support Nahiro.net","https:\u002F\u002Fprofiles.wordpress.org\u002Fnahiro\u002F","\u003Cp>the WordPress locations plugin “Interactive Map Widget” is ideal for entrepreneurs. It allows the integration of interactive maps with different locations on websites. Pins show information such as name, photo, phone number and email address. \u003Cstrong>Fully compatible with Elementor.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Ch4>Practical and simple to use\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Interactive Map Widget for Elementor\u003C\u002Fstrong> as a WordPress tool will definitely simplify your work significantly and provide real value to your customers. It is the key to excellence in visualizing geographic data on WordPress.\u003C\u002Fp>\n\u003Cp>To transform the way your visitors interact with your geographic content, the Interactive Map offers a visually and functionally superior and engaging experience. It’s more than just a simple add-on; it’s an essential tool that enriches your website by allowing you to create detailed interactive maps with amazing ease.\u003C\u002Fp>\n\u003Cp>Designed to \u003Cstrong>integrate seamlessly with WordPress and Elementor\u003C\u002Fstrong>, this widget allows you to use a drag-and-drop interface to fully personalize your maps, making implementation intuitive and accessible to everyone, regardless of their technical level.\u003C\u002Fp>\n\u003Cp>With the ability to draw maps of specific countries and their regions, you can present key information in a way that’s easy to understand and visually appealing. Each pin on your map isn’t just a marker; it’s a gateway to a rich information map with details like photos, contacts, and descriptions that appear with a simple click, greatly improving user engagement.\u003C\u002Fp>\n\u003Cp>Furthermore, customization is where the Interactive Map Widget for Elementor really shines. You can adjust everything from the size and color of the pins and maps to the alignment and overall layout to ensure that every element of the map is perfectly in line with your brand’s aesthetic. This not only improves the visual coherence of your page, but also reinforces your corporate identity at every point of interaction.\u003C\u002Fp>\n\u003Ch4>WordPress map with locations, optimized for the DACH region\u003C\u002Fh4>\n\u003Cp>Discover the powerful “Interactive Map Widget”! This WordPress locations plugin is specially optimized for the DACH region and allows you to create and customize interactive maps for any city. Fully compatible with WordPress and Elementor Pro, our plugin offers lightweight and lightning-fast performance.\u003C\u002Fp>\n\u003Cp>It allows companies to seamlessly integrate visually appealing, interactive maps into their websites. With extensive style configuration options and user-friendly operation, it is the ideal tool to improve your online presence and offer your customers an impressive user experience. Turn your website into an interactive experience with our innovative map solution!\u003C\u002Fp>\n\u003Ch4>Integration with WordPress and Elementor\u003C\u002Fh4>\n\u003Cp>Interactive Map Widget is specially designed for websites that use WordPress and leverage the power of Elementor, one of the most popular and flexible page builders on the market. This integration ensures that users can easily implement and configure the widget, leveraging Elementor’s intuitive interface for fast and efficient design.\u003C\u002Fp>\n\u003Ch4>WordPress locations plugin, creation of maps with regional subdivisions\u003C\u002Fh4>\n\u003Cp>One of the main features of the WordPress Locations Plugin, Interactive Map Widget is its ability to draw detailed maps of countries, including internal regional divisions. Users can select any country they want to display and customize the map to fit the specific needs of their project or presentation.\u003C\u002Fp>\n\u003Ch4>WordPress map with locations, information cards when clicking on the pins\u003C\u002Fh4>\n\u003Cp>Clicking on any pin displays an information card that may contain data such as the name, photo, phone number and email address of the person or place depicted.\u003C\u002Fp>\n\u003Cp>The maps are also customizable, with options that allow you to change the style, text size, color, and more to ensure that the presentation of information is clear and consistent with the website’s visual identity.\u003C\u002Fp>\n\u003Ch4>Features\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Interactive Maps \u003Cstrong>for Elementor\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Customizable Pins\u003C\u002Fli>\n\u003Cli>Include Maps from: Austria, Argentina, Belgium, China, France, Germany, Japan, \u003C\u002Fli>\n\u003Cli>Ireland, Italy, Luxembourg, Poland, Portugal, Spain, United States, Venezuela and more.\u003C\u002Fli>\n\u003Cli>Fast and light.\u003C\u002Fli>\n\u003Cli>Excellent resolution on any screen\u003C\u002Fli>\n\u003Cli>User-friendly\u003C\u002Fli>\n\u003Cli>Active languages: English, German, Spanish.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fnahiro.net\u002Fen\u002Fwordpress-help\u002F\" rel=\"nofollow ugc\">WordPress Hilfe & Support – Nahiro.net\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch4>Interactive Map Widget Pro\u003C\u002Fh4>\n\u003Cp>To further improve the interactive map widget we released “Interactive Map WIdget Pro” a professional version of the free plugin constantly evolving and improving.\u003C\u002Fp>\n\u003Cp>The professional version of this plugin includes everything in the free version and more additional features listed below:\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>⭐️ \u003Cstrong>Unlimited pins\u002Fmarkers:\u003C\u002Fstrong> mark multiple locations in any point of a region without worrying about limits\u003Cbr \u002F>\n  ⭐️ \u003Cstrong>More maps:\u003C\u002Fstrong> you can have more different maps with different countries on your page, don’t limit yourself to just one!\u003Cbr \u002F>\n  ⭐️ \u003Cstrong>Adjustable cards: \u003C\u002Fstrong> In any card if your content grows beyond expected the card grows with you! No need to make adjustments, we do it for you. Card height and image proportion on cards adjust individually to give you flexibility\u003Cbr \u002F>\n  ⭐️ \u003Cstrong>New rich content field: \u003C\u002Fstrong> introducing a new card field that allows you to add formatted content! Add headings, links, bullet list and more to your cards content.\u003Cbr \u002F>\n  ⭐️ \u003Cstrong>More personalization options\u003C\u002Fstrong>\u003Cbr \u002F>\n  ⭐️ \u003Cstrong>New features:\u003C\u002Fstrong>  the professional version will constantly improve, quality of life improvement or feature will be released in this version. The free version won’t receive new features frequently.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>Are you interested? Check out: \u003Ca href=\"https:\u002F\u002Fnahiro.net\u002Fen\u002Finteractive-map-for-elementor-pro\u002F\" rel=\"nofollow ugc\">Interactive Map Widget Pro\u003C\u002Fa>\u003C\u002Fp>\n","Interactive map widget for Elementor: Add maps with markers, titles, images, and links to posts and pages.",6049,"2026-07-01T13:45:00.000Z","7.0.0","5.2","7.4",[139,140,81,141,142],"business-locations","elementor-widget","map-with-locations","store-locator","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Finteractive-map-widget.1.2.27.zip",{"slug":145,"name":146,"version":147,"author":148,"author_profile":149,"description":150,"short_description":151,"active_installs":57,"downloaded":152,"rating":124,"num_ratings":153,"last_updated":154,"tested_up_to":76,"requires_at_least":155,"requires_php":137,"tags":156,"homepage":159,"download_link":160,"security_score":124,"vuln_count":11,"unpatched_count":11,"last_vuln_date":35,"fetched_at":27},"picpoints","PicPoints – Interactive SVG Image Maps, Hotspots Builder","1.12.1","Yalogica","https:\u002F\u002Fprofiles.wordpress.org\u002Fyalogica\u002F","\u003Cp>\u003Cstrong>🏆 The Best Interactive Image Map and Hotspots Builder Plugin for WordPress\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fyalogica.com\u002Fmaps\u002F?utm_source=wordpress.org&utm_medium=ref&utm_campaign=showcases\" rel=\"nofollow ugc\">Showcases\u003C\u002Fa> | \u003Ca href=\"https:\u002F\u002Fyalogica.com\u002Fpicpoints\u002F?utm_source=wordpress.org&utm_medium=ref&utm_campaign=promo\" rel=\"nofollow ugc\">Upgrade Pro\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>PicPoints is the most advanced, developer-friendly \u003Cstrong>interactive image map\u003C\u002Fstrong> and \u003Cstrong>floor plan builder\u003C\u002Fstrong> for WordPress. Built for extreme performance and modern web standards, this \u003Cstrong>hotspot plugin\u003C\u002Fstrong> handles hundreds of interactive elements effortlessly without lagging your website.\u003C\u002Fp>\n\u003Cp>Unlike traditional \u003Cstrong>image mapping tools\u003C\u002Fstrong> that break during WordPress theme updates, PicPoints renders entirely inside an isolated \u003Cstrong>Shadow DOM\u003C\u002Fstrong>. This guarantees 100% CSS and JS isolation, your theme’s styles will never break your \u003Cstrong>interactive maps\u003C\u002Fstrong>, and your maps will never slow down your site page speed.\u003C\u002Fp>\n\u003Ch3>🔥 Live Demos:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fyalogica.com\u002Fmaps\u002Fmarket-mall-map\u002F?utm_source=wordpress.org&utm_medium=ref&utm_campaign=live-demo\" rel=\"nofollow ugc\">Market Mall\u003C\u002Fa> – Interactive map for shopping malls and retail centers.\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fyalogica.com\u002Fmaps\u002Finteractive-real-estate-map\u002F?utm_source=wordpress.org&utm_medium=ref&utm_campaign=live-demo\" rel=\"nofollow ugc\">Real Estate Map\u003C\u002Fa> – Interactive map solution for property and real estate listings.\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fyalogica.com\u002Fmaps\u002Finteractive-human-body-muscle-diagram\u002F?utm_source=wordpress.org&utm_medium=ref&utm_campaign=live-demo\" rel=\"nofollow ugc\">Human Body Muscle Diagram\u003C\u002Fa> – Interactive anatomy diagram showcasing human muscles.\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fyalogica.com\u002Fmaps\u002Finteractive-product-explainer\u002F?utm_source=wordpress.org&utm_medium=ref&utm_campaign=live-demo\" rel=\"nofollow ugc\">Product Explainer\u003C\u002Fa> – Interactive image wrapper for detailed product features and explanations.\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fyalogica.com\u002Fmaps\u002Finteractive-stadium-map\u002F?utm_source=wordpress.org&utm_medium=ref&utm_campaign=live-demo\" rel=\"nofollow ugc\">Stadium Map\u003C\u002Fa> – Interactive seating chart and layout map for stadiums or arenas.\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fyalogica.com\u002Fmaps\u002Finteractive-camera-gear-kit\u002F?utm_source=wordpress.org&utm_medium=ref&utm_campaign=live-demo\" rel=\"nofollow ugc\">Camera Gear Kit\u003C\u002Fa> – Interactive breakdown map for photography gear and equipment kits.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002FCUHjfWBPMp4?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\n\u003Cp>Whether you need to build a multi-story \u003Cstrong>real estate floor plan\u003C\u002Fstrong>, an interactive \u003Cstrong>product anatomy showcase\u003C\u002Fstrong>, a \u003Cstrong>shoppable e-commerce lookbook\u003C\u002Fstrong>, or a vector-accurate \u003Cstrong>event seating chart\u003C\u002Fstrong>, PicPoints provides a Figma-like SVG vector editor right inside your WordPress dashboard.\u003C\u002Fp>\n\u003Cp>Draw complex \u003Cstrong>clickable image\u003C\u002Fstrong> shapes with pixel-perfect accuracy using native Bezier curves, group layers, and create rich-content popups and tooltips in minutes.\u003C\u002Fp>\n\u003Ch3>🚀 Key Features of PicPoints Interactive Map Plugin:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Isolated Shadow DOM Architecture:\u003C\u002Fstrong> Zero CSS conflicts with your WP theme. 100% visual consistency on any website.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>High-Performance Image Mapping:\u003C\u002Fstrong> Hardcore optimization tested with up to 1,000 active vector shapes on a single canvas.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Pro-Grade SVG Vector Editor:\u003C\u002Fstrong> Draw ellipses, rectangles, markers, and custom polygons with smooth Bezier curves.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Multi-Scene & Multi-Level Floor Plans:\u003C\u002Fstrong> Perfect for real estate marketing (Floor 1, Floor 2, Floor 3) and complex architectural blueprints.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Figma-Like Layer Management:\u003C\u002Fstrong> Group, rename, and organize your vector shapes, pointers, and markers hierarchically.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Fully Responsive Clickable Images:\u003C\u002Fstrong> Adapts flawlessly to mobile devices, tablets, and desktops with smart touch and zoom controls.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Rich Tooltips & Hotspot Popups:\u003C\u002Fstrong> Trigger automated tooltips on hover or open rich-media popups (images, text, WooCommerce products, iframes) on click.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🔥 Features\u003C\u002Fh3>\n\u003Cp>PicPoints Free is the perfect \u003Cstrong>interactive image map tool\u003C\u002Fstrong> for small projects and testing. PicPoints Pro unlocks the full potential for professional web development agencies, e-commerce stores, and realtors.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>PicPoints Free\u003C\u002Fstrong> – General Features\u003Cbr \u002F>\n⚡ \u003Cstrong>Number of maps:\u003C\u002Fstrong> Max 3\u003Cbr \u002F>\n⚡ \u003Cstrong>Number of scenes (levels) per map:\u003C\u002Fstrong> Max 3\u003Cbr \u002F>\n⚡ \u003Cstrong>Number of interactive layers\u002Fmarkers per scene:\u003C\u002Fstrong> Max 10\u003Cbr \u002F>\n✅ \u003Cstrong>Markers:\u003C\u002Fstrong> non-scalable pins (icon + text or image) with custom anchor point positioning.\u003Cbr \u002F>\n✅ \u003Cstrong>SVG Layers:\u003C\u002Fstrong> rectangles, ellipses, images, text (with left\u002Fcenter\u002Fright alignment), and polygons.\u003Cbr \u002F>\n✅ \u003Cstrong>Smart Undo\u002FRedo History:\u003C\u002Fstrong> full history stack to undo\u002Fredo changes for scenes & layers.\u003Cbr \u002F>\n✅ \u003Cstrong>Mobile Responsive:\u003C\u002Fstrong> perfect adaptation to any screen size.\u003Cbr \u002F>\n✅ \u003Cstrong>Touch Gestures:\u003C\u002Fstrong> supports mobile pan & pinch multi-touch zooming.\u003Cbr \u002F>\n✅ Standard Tooltips & Popups (Auto-close enabled)\u003Cbr \u002F>\n✅ Flexible tooltip positions: top, bottom, left, right, center, follow\u003Cbr \u002F>\n✅ Strict Pan & Zoom behavior\u003Cbr \u002F>\n✅ Change viewport & scene background, can be color or image\u003C\u002Fp>\n\u003Cp>\u003Cstrong>PicPoints Free\u003C\u002Fstrong> – Widgets\u003Cbr \u002F>\n✅ \u003Cstrong>Scene Title\u003C\u002Fstrong>\u003Cbr \u002F>\n✅ \u003Cstrong>Scene Navigation Dots\u003C\u002Fstrong>\u003Cbr \u002F>\n✅ \u003Cstrong>Scene Navigation Switcher\u003C\u002Fstrong>\u003Cbr \u002F>\n✅ \u003Cstrong>Fullscreen Toggle\u003C\u002Fstrong>\u003Cbr \u002F>\n✅ \u003Cstrong>Fit to Screen Action\u003C\u002Fstrong>\u003Cbr \u002F>\n✅ \u003Cstrong>Zoom Controls (+\u002F-)\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>\u003Cstrong>PicPoints Pro\u003C\u002Fstrong> includes everything from Free, plus:\u003Cbr \u002F>\n✅✨ \u003Cstrong>Unlimited Maps, Scenes, and Layers\u003C\u002Fstrong> for enterprise-scale projects.\u003Cbr \u002F>\n✅✨ \u003Cstrong>Import layers from SVG\u003C\u002Fstrong> import \u003Ccode>\u003Cg>\u003C\u002Fcode> and \u003Ccode>\u003Cpath>\u003C\u002Fcode> vector elements from Illustrator or Inkscape with automatic layer tree and partial style retention.\u003Cbr \u002F>\n✅✨ \u003Cstrong>Auto-Load\u003C\u002Fstrong> toggle map auto-loading on\u002Foff or configure a custom delay timer to optimize website page load speed.\u003Cbr \u002F>\n✅✨ \u003Cstrong>Greeting dialog\u003C\u002Fstrong> show message before map load.\u003Cbr \u002F>\n✅✨ \u003Cstrong>Bulk Attribute Editing\u003C\u002Fstrong> select multiple layers or groups at once to edit, update, or assign common custom metadata.\u003Cbr \u002F>\n✅✨ \u003Cstrong>Advanced Handlebars Templates\u003C\u002Fstrong> use classic Handlebars logic ({{variable}}, {{#if}}, {{#each}}) inside Tooltips and Popups to build highly dynamic, data-driven layouts without coding.\u003Cbr \u002F>\n✅✨ \u003Cstrong>Physics-Based Canvas Bounce\u003C\u002Fstrong> advanced configurations for a smooth viewport experience.\u003Cbr \u002F>\n✅✨ \u003Cstrong>Custom JS & CSS Sections\u003C\u002Fstrong> per map and per element for infinite extensibility.\u003Cbr \u002F>\n✅✨ \u003Cstrong>Developer API Access\u003C\u002Fstrong> to connect your interactive maps with external CRM, WooCommerce, or custom databases.\u003Cbr \u002F>\n✅✨ \u003Cstrong>Priority email support\u003C\u002Fstrong> for agencies and businesses that need fast help.\u003C\u002Fp>\n\u003Cp>\u003Cem>Note: The undo\u002Fredo history covers all scene or layer movements and visual style modifications. Rich content formatting changes inside tooltips and popups bypass the history stack.\u003C\u002Fem>\u003C\u002Fp>\n\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002F6DdZDq7EqmQ?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\n\u003Ch3>🚀 Compatibility\u003C\u002Fh3>\n\u003Cp>Not all themes and plugins are built the same way, so PicPoints is designed with extra compatibility in mind.​ PicPoints works seamlessly with modern WordPress themes and popular page builders that support standard blocks and shortcodes.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>PAGE BUILDERS\u003C\u002Fstrong>\u003Cbr \u002F>\n* \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fgutenberg\u002F\" rel=\"ugc\">Gutenberg\u003C\u002Fa> – modern built-in WordPress block editor\u003Cbr \u002F>\n* \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fclassic-editor\u002F\" rel=\"ugc\">Classic Editor\u003C\u002Fa> – classic built-in WordPress editor\u003Cbr \u002F>\n* \u003Ca href=\"https:\u002F\u002Felementor.com\u002F\" rel=\"nofollow ugc\">Elementor\u003C\u002Fa> – leading website builder platform on WordPress\u003Cbr \u002F>\n* \u003Ca href=\"https:\u002F\u002Fwpbakery.com\u002F\" rel=\"nofollow ugc\">WP Bakery\u003C\u002Fa> – create any layout with intuitive way\u003Cbr \u002F>\n* \u003Ca href=\"https:\u002F\u002Fwww.wpbeaverbuilder.com\u002F\" rel=\"nofollow ugc\">Beaver\u003C\u002Fa> – page builder you can trust with your business\u003Cbr \u002F>\n* \u003Ca href=\"https:\u002F\u002Fbricksbuilder.io\u002F\" rel=\"nofollow ugc\">Bricks\u003C\u002Fa> – amazing block editor with many templates\u003Cbr \u002F>\n* \u003Ca href=\"https:\u002F\u002Fwww.brizy.io\u002F\" rel=\"nofollow ugc\">Brizy\u003C\u002Fa> – next-gen website builder that anyone can use\u003Cbr \u002F>\n* and more…\u003C\u002Fp>\n\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002Fc61X3wxrohk?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\n\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002Fyk9iK76KuFU?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\n\u003Ch3>🎓 Use Cases\u003C\u002Fh3>\n\u003Cp>PicPoints serves as a lightweight, modern, and high-performance alternative to established WordPress interactive mapping plugins like Mapplic, ImageMap Pro, MapSVG, WP Draw Attention, Image Hotspot by DevVN, and Vision.\u003C\u002Fp>\n\u003Cp>With PicPoints, you can easily visually outline complex geometries, group interactive elements, and embed \u003Cstrong>shoppable lookbooks\u003C\u002Fstrong> or \u003Cstrong>interactive architecture maps\u003C\u002Fstrong> via a simple shortcode.\u003C\u002Fp>\n\u003Cp>The plugin balances intuitive usability for non-technical users with rich customization and advanced Developer APIs for design agencies, making it the ultimate tool for boosting on-site conversion and spatial user engagement without slowing down your WordPress website.\u003C\u002Fp>\n\u003Ch3>💼 GDPR & Privacy\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>We do not collect or store any information about our visitors or users without their consent.\u003C\u002Fli>\n\u003Cli>We also do not transfer any data to external servers without users’ consent.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🔥 Check out our other WordPress Plugins\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fhappyvr\u002F\" rel=\"ugc\">\u003Cstrong>HappyVR\u003C\u002Fstrong>\u003C\u002Fa> – virtual tour builder and 360 panorama viewer for WordPress\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fmediacommander\u002F\" rel=\"ugc\">\u003Cstrong>MediaCommander\u003C\u002Fstrong>\u003C\u002Fa> – bring folders to media, posts, and pages\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fninjadraw\u002F\" rel=\"ugc\">\u003Cstrong>NinjaDraw\u003C\u002Fstrong>\u003C\u002Fa> – create diagrams, sketches & visual workflows\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fpost-order-master\u002F\" rel=\"ugc\">\u003Cstrong>Post Order Master\u003C\u002Fstrong>\u003C\u002Fa> – free drag & drop hierarchy manager\u003C\u002Fp>\n\u003Ch3>Support\u003C\u002Fh3>\n\u003Cp>Found an issue or have a feature request? Head over to our \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fsupport\u002Fplugin\u002Fpicpoints\u002F\" rel=\"ugc\">support forum\u003C\u002Fa> or drop us an email for assistance. We’re here to help you create stunning floor plans and image maps with ease!\u003C\u002Fp>\n","Best WordPress interactive image map plugin to create responsive floor plans, shoppable lookbooks, SVG vector shapes, and clickable photo hotspots.",2131,2,"2026-07-22T08:13:00.000Z","6.0",[80,157,158,81,82],"floor-plan","hotspots","https:\u002F\u002Fyalogica.com\u002Fpicpoints","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpicpoints.1.12.1.zip",{"attackSurface":162,"codeSignals":203,"taintFlows":217,"riskAssessment":272,"analyzedAt":283},{"hooks":163,"ajaxHandlers":185,"restRoutes":195,"shortcodes":196,"cronEvents":201,"entryPointCount":202,"unprotectedCount":47},[164,170,172,175,177,182],{"type":165,"name":166,"callback":167,"file":168,"line":169},"action","admin_enqueue_scripts","anonymous","includes\u002Fclass-svg-map-by-saedi.php",43,{"type":165,"name":166,"callback":167,"file":168,"line":171},44,{"type":165,"name":173,"callback":167,"file":168,"line":174},"wp_enqueue_scripts",59,{"type":165,"name":173,"callback":167,"file":168,"line":176},60,{"type":165,"name":178,"callback":179,"file":180,"line":181},"plugins_loaded","svg_map_saedi_load_textdomain","svg-map-by-saedi.php",23,{"type":165,"name":183,"callback":184,"file":180,"line":174},"admin_menu","svg_map_saedi_setup_menu",[186,189,192],{"action":187,"nopriv":46,"callback":167,"hasNonce":46,"hasCapCheck":46,"file":168,"line":188},"svg_map_save",46,{"action":190,"nopriv":46,"callback":167,"hasNonce":46,"hasCapCheck":46,"file":168,"line":191},"svg_map_delete",47,{"action":193,"nopriv":46,"callback":167,"hasNonce":46,"hasCapCheck":46,"file":168,"line":194},"svg_map_popup",48,[],[197],{"tag":198,"callback":199,"file":168,"line":200},"display_svg_map","display_map",62,[],4,{"dangerousFunctions":204,"sqlUsage":205,"outputEscaping":208,"fileOperations":153,"externalRequests":11,"nonceChecks":25,"capabilityChecks":153,"bundledLibraries":216},[],{"prepared":206,"raw":11,"locations":207},6,[],{"escaped":209,"rawEcho":153,"locations":210},74,[211,214],{"file":212,"line":24,"context":213},"admin\u002Fsvg-map.php","raw output",{"file":212,"line":215,"context":213},166,[],[218,255],{"entryPoint":219,"graph":220,"unsanitizedCount":11,"severity":254},"save_data (admin\u002Fclass-svg-map-by-saedi-admin.php:69)",{"nodes":221,"edges":248},[222,228,233,236,238,241,243,246],{"id":223,"type":224,"label":225,"file":226,"line":227},"n0","source","$_POST['base_color']","admin\u002Fclass-svg-map-by-saedi-admin.php",81,{"id":229,"type":230,"label":231,"file":226,"line":227,"wp_function":232},"n1","sink","update_option() [Settings Manipulation]","update_option",{"id":234,"type":224,"label":235,"file":226,"line":107},"n2","$_POST['select_color']",{"id":237,"type":230,"label":231,"file":226,"line":107,"wp_function":232},"n3",{"id":239,"type":224,"label":240,"file":226,"line":60},"n4","$_POST['popup_bg_color']",{"id":242,"type":230,"label":231,"file":226,"line":60,"wp_function":232},"n5",{"id":244,"type":224,"label":245,"file":226,"line":58},"n6","$_POST['popup_txt_color']",{"id":247,"type":230,"label":231,"file":226,"line":58,"wp_function":232},"n7",[249,251,252,253],{"from":223,"to":229,"sanitized":250},true,{"from":234,"to":237,"sanitized":250},{"from":239,"to":242,"sanitized":250},{"from":244,"to":247,"sanitized":250},"low",{"entryPoint":256,"graph":257,"unsanitizedCount":11,"severity":254},"\u003Cclass-svg-map-by-saedi-admin> (admin\u002Fclass-svg-map-by-saedi-admin.php:0)",{"nodes":258,"edges":267},[259,260,261,262,263,264,265,266],{"id":223,"type":224,"label":225,"file":226,"line":227},{"id":229,"type":230,"label":231,"file":226,"line":227,"wp_function":232},{"id":234,"type":224,"label":235,"file":226,"line":107},{"id":237,"type":230,"label":231,"file":226,"line":107,"wp_function":232},{"id":239,"type":224,"label":240,"file":226,"line":60},{"id":242,"type":230,"label":231,"file":226,"line":60,"wp_function":232},{"id":244,"type":224,"label":245,"file":226,"line":58},{"id":247,"type":230,"label":231,"file":226,"line":58,"wp_function":232},[268,269,270,271],{"from":223,"to":229,"sanitized":250},{"from":234,"to":237,"sanitized":250},{"from":239,"to":242,"sanitized":250},{"from":244,"to":247,"sanitized":250},{"summary":273,"deductions":274},"The \"svg-map-by-saedi\" plugin, version 1.0.3, exhibits a mixed security posture. On the positive side, it demonstrates good practices by using prepared statements for all SQL queries and properly escaping the vast majority of its output. The absence of dangerous functions and external HTTP requests is also encouraging. However, the plugin presents significant risks due to its unprotected entry points.\n\nSpecifically, the presence of three AJAX handlers without authentication checks represents a critical vulnerability. This lack of authorization means that any user, potentially including unauthenticated visitors, could trigger these handlers, leading to unpredictable behavior or even unauthorized actions. While the taint analysis shows no unsanitized paths, the sheer number of unprotected AJAX handlers creates a substantial attack surface that could be exploited.\n\nThe plugin's vulnerability history, which includes one known medium-severity CVE that is currently unpatched, is a significant concern. The fact that the last vulnerability occurred in the future (2026-01-06) suggests potential data inaccuracies or a placeholder for future events, but the presence of an unpatched vulnerability itself is a red flag. The common vulnerability type being Cross-Site Request Forgery (CSRF) further emphasizes the need for robust authentication and authorization mechanisms, which are clearly lacking in the exposed AJAX handlers. The plugin's strengths lie in its secure handling of database interactions and output, but these are overshadowed by the critical security flaws in its entry points and the existence of an unpatched vulnerability.",[275,278,281],{"reason":276,"points":277},"Unpatched CVE exists",18,{"reason":279,"points":280},"AJAX handlers without auth checks",15,{"reason":282,"points":47},"Nonce check exists but is low","2026-04-16T13:01:51.015Z",{"wat":285,"direct":298},{"assetPaths":286,"generatorPatterns":291,"scriptPaths":292,"versionParams":293},[287,288,289,290],"\u002Fwp-content\u002Fplugins\u002Fsvg-map-by-saedi\u002Fcss\u002Fsvg-map-by-saedi-admin.css","\u002Fwp-content\u002Fplugins\u002Fsvg-map-by-saedi\u002Fjs\u002Fsvg-map-by-saedi-admin.js","\u002Fwp-content\u002Fplugins\u002Fsvg-map-by-saedi\u002Fpublic\u002Fcss\u002Fsvg-map-by-saedi-public.css","\u002Fwp-content\u002Fplugins\u002Fsvg-map-by-saedi\u002Fpublic\u002Fjs\u002Fsvg-map-by-saedi-public.js",[],[288,290],[294,295,296,297],"svg-map-by-saedi\u002Fcss\u002Fsvg-map-by-saedi-admin.css?ver=","svg-map-by-saedi\u002Fjs\u002Fsvg-map-by-saedi-admin.js?ver=","svg-map-by-saedi\u002Fpublic\u002Fcss\u002Fsvg-map-by-saedi-public.css?ver=","svg-map-by-saedi\u002Fpublic\u002Fjs\u002Fsvg-map-by-saedi-public.js?ver=",{"cssClasses":299,"htmlComments":302,"htmlAttributes":303,"restEndpoints":306,"jsGlobals":310,"shortcodeOutput":313},[300,301],"world-map-admin","svg-map-container",[],[304,305],"data-point","data-popup-content",[307,308,309],"\u002Fwp-json\u002Fsvg-map\u002Fv1\u002Fsave","\u002Fwp-json\u002Fsvg-map\u002Fv1\u002Fdelete","\u002Fwp-json\u002Fsvg-map\u002Fv1\u002Fpopup",[311,312],"svgMapSecurity","svgMapPublic",[314],"[display_svg_map]",{"error":250,"url":316,"statusCode":317,"statusMessage":318,"message":318},"http:\u002F\u002Flocalhost\u002Fapi\u002Fplugins\u002Fsvg-map-by-saedi\u002Fbundle",404,"no bundle for this plugin yet",{"slug":4,"current_version":6,"total_versions":153,"versions":320},[321,327],{"version":6,"download_url":23,"svn_tag_url":322,"released_at":35,"has_diff":46,"diff_files_changed":323,"diff_lines":35,"trac_diff_url":324,"vulnerabilities":325,"is_current":250},"https:\u002F\u002Fplugins.svn.wordpress.org\u002Fsvg-map-by-saedi\u002Ftags\u002F1.0.3\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fsvg-map-by-saedi%2Ftags%2F1.0.1&new_path=%2Fsvg-map-by-saedi%2Ftags%2F1.0.3",[326],{"id":31,"url_slug":32,"title":33,"severity":37,"cvss_score":38,"vuln_type":40,"patched_in_version":35},{"version":328,"download_url":329,"svn_tag_url":330,"released_at":35,"has_diff":46,"diff_files_changed":331,"diff_lines":35,"trac_diff_url":35,"vulnerabilities":332,"is_current":46},"1.0.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsvg-map-by-saedi.1.0.1.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fsvg-map-by-saedi\u002Ftags\u002F1.0.1\u002F",[],[333],{"id":31,"url_slug":32,"title":33,"severity":37,"cvss_score":38,"vuln_type":40,"patched_in_version":35}]