The YaMaps for WordPress plugin contains a stored cross‑site scripting flaw triggered by the yamap shortcode parameters. Insufficient input sanitization and improper output escaping allow an authenticated user with Contributor‑level privileges or higher to inject malicious scripts that persist in the post content and execute whenever a page containing the shortcode is viewed by any user. This type of flaw can lead to defacement, credential theft, or the delivery of further payloads to site visitors. The vulnerability is specifically a CWE‑79 type weakness involving unsafe handling of user data in generated HTML.

Only the YaMaps for WordPress plugin is affected, specifically all releases up to and including version 0.6.40. The plugin is distributed by the vendor identified as yhunter.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of immediate exploitation, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have Contributor or higher role access, so an insider risk is present but external exploitation without additional compromise remains unlikely. Nevertheless, once the fault is exploited, any site visitor to a page containing the injected content will run arbitrary code.