The Geopost plugin is vulnerable to a stored cross‑site scripting flaw that allows an authenticated user with contributor privileges or higher to inject arbitrary JavaScript via the "height" attribute of the geopost shortcode. When a page containing the injected shortcode is viewed, the script executes in the context of each visitor, potentially enabling credential theft, defacement, or other client‑side attacks.

The vulnerability affects the Geopost plugin for WordPress, produced by rampantlogic, in all releases up to and including version 1.2.

The flaw carries a CVSS score of 6.4, indicating moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation at this time, and the issue is not listed in the CISA KEV catalog. Attackers must be authenticated and hold at least contributor access, then exploit the inadequate input sanitization and output escaping on the live editing interface to embed malicious payloads that run for all users who visit the affected page.