The plugin fails to serve cached data from server‑side responses and instead trusts user input, allowing unauthenticated attackers to inject malicious content into the cache for location search results. This leads to integrity violations, potentially delivering arbitrary data to site visitors. The weakness is a Cache Poisoning flaw (CWE‑349).

WP Go Maps (formerly WP Google Maps) plugin for WordPress, versions up to and including 9.0.48 are vulnerable. Any WordPress site running this plugin before upgrading to 9.0.49 or newer is affected.

The CVSS score of 5.3 reflects moderate risk. An EPSS score of less than 1% indicates a low likelihood of exploitation at the time of analysis, and the vulnerability is not listed in CISA KEV. Because the flaw relies solely on user input, the attack vector is likely unrestricted network traffic, but the modest score and low exposure probability suggest a moderate threat level that warrants timely remediation.