Mind Doodle Visual Sitemaps & Tasks allows attackers to store arbitrary JavaScript in the plugin’s data repository. When an affected visitor loads a page that renders this data, the malicious code runs in the user’s browser. This Stored XSS vulnerability can be used to steal session cookies, manipulate page content, and perform further client‑side attacks. The weakness is classified as CWE‑79.

The vulnerability exists in Mind Doodle Visual Sitemaps & Tasks versions from initial releases through and including 1.6. Users of any release numbered 1.6 or lower are potentially affected.

With a CVSS score of 6.5, the problem is of moderate severity. The EPSS score of less than 1% indicates the exploitation probability is low, and the vulnerability is not listed in CISA's KEV catalog. Attackers would need the ability to submit data to the plugin—most likely via the admin interface to create or edit map or task entries—to embed the malicious payload. Once embedded, the code is served to all site visitors, enabling widespread client‑side compromise.