The Site Editor Google Map plugin contains an improper input neutralization flaw that permits reflected cross‑site scripting. By embedding malicious JavaScript in a URL, an attacker can cause the script to run in the browser context of any user who opens the link. The script runs with the privileges of the page, allowing session hijacking, defacement, or extraction of sensitive data.

The plugin vendor is wpsiteeditor, product Site Editor Google Map. All releases up to and including version 1.0.1 are affected. Sites that have installed the plugin in this range are vulnerable; no specific WordPress core version is mentioned, so any WordPress installation using the plugin is at risk.

The CVSS score of 7.1 marks the flaw as high severity. The EPSS score of less than 1% suggests that real‑world exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need to entice a user to click a crafted URL, a common method for reflected XSS, and the flaw does not depend on stored data or authentication.