A stored cross‑site scripting flaw in the WP Maps plugin enables an authenticated contributor or higher to inject arbitrary JavaScript into the shortcode attributes of the 'put_wpgm' tag. Once injected, the script executes automatically for every visitor who views the affected page, exposing the site to session hijacking, defacement, or malicious redirects. The vulnerability stems from a lack of input sanitization and output escaping.

WordPress sites that have the WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin installed in any version up to and including 4.8.7 are impacted. Any user who can add or edit content with contributor‑level access on these sites can exploit the flaw, and all users who subsequently view the compromised page are at risk.

The CVSS score of 6.4 indicates moderate severity, but the flaw is exploitable by authenticated users and can affect all visitors to the site, making it a high‑impact issue for exposed audiences. The EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to supply malicious data via the plugin’s shortcode, and the attack surface is limited to users who load the affected content. However, because the injected script executes in the context of the website, the potential consequences span confidentiality, integrity, and availability.