Improper neutralization of input during web page generation allows attackers to inject malicious JavaScript into a post or page that is then reflected back to the user’s browser. The vulnerability, classified as CWE‑79, can lead to credential theft, session hijacking, defacement, and other client‑side attacks. It is a reflected XSS flaw, meaning an attacker merely needs to craft a URL or submit a request that includes the exploitable payload.

The flaw affects the Google Map on Post/Page WordPress plugin developed by sunil chaulagain. Any installation of the plugin up to and including version 1.1 is vulnerable; the vulnerability is present from the earliest released version through 1.1.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1 % suggests a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The most likely attack vector is through a crafted URL or form input that is displayed without proper escaping, enabling the reflection of attacker‑supplied script into the rendered page.