The Coon Google Maps WordPress plugin is vulnerable to stored cross‑site scripting because the 'height' parameter supplied by the [map] shortcode is not properly sanitized or escaped. When a user with contributor or higher privileges injects malicious script through this parameter, the script is saved with the post and executed whenever anyone views the page containing the shortcode. This can lead to defacement, cookie theft, session hijacking, or arbitrary code execution on the browser of any visitor. The weakness corresponds to CWE‑79.

The vulnerability affects all installations of the andrico Coon Google Maps plugin at version 1.0 and earlier. No specific WordPress core version or additional plugin dependencies are provided in the advisory. Any site that has the plugin installed and allows contributors to generate or edit posts with shortcode usage is at risk.

The CVSS score of 6.4 indicates a medium severity level, and the EPSS score of less than 1% suggests that exploitation is unlikely in the wild, though the vulnerability is not listed in CISA KEV. Because exploitation requires an attacker to have contributor or higher permissions, the attack vector is authenticated. An attacker can craft a malicious value for the 'height' attribute in a shortcode that is then stored and rendered to visitors of the post, leading to cross‑site scripting of the affected pages.