The MapGeo plugin contains a reflected XSS flaw that allows an attacker to inject script code via the 'map' parameter of its shortcode. Because the plugin fails to sanitize user input or escape output, a crafted URL can be embedded in a page that a victim visits. When the victim triggers the page, the malicious script runs in the victim’s browser, potentially compromising user credentials, session cookies, or enabling phishing attacks.

All installations of the Interactive Geo Maps WordPress plugin with version 1.6.27 or earlier are affected. The flaw exists in every release up to and including 1.6.27. Users running an earlier or newer version are not vulnerable.

The CVSS score of 6.1 indicates medium severity, and the exploit is trivial to launch because it requires only a crafted URL and does not need authentication. Although EPSS data is unavailable and the vulnerability is not listed in CISA KEV, the possibility of widespread exposure remains because the plug‑in can be present on many WordPress sites. The likely attack vector is a reflected input via the map parameter in a publicly accessible shortcode.