This vulnerability arises from improper neutralization of input during web page generation in the Google Map With Fancybox location‑piker plugin. When a user supplies unsanitized input, the plugin reflects that data directly into a web page, allowing an attacker to inject malicious script. The weakness is a Classic Cross‑Site Scripting flaw (CWE‑79), which can compromise user credentials, deface sites, or launch further attacks while presenting the victim’s browser as a trusted user.

WordPress sites that use the Google Map With Fancybox plugin by Uzzal Mondal, versions n/a through 2.1.0. Any site that has not yet upgraded the plugin from this series is affected.

The vulnerability scores 7.1 on the CVSS scale, indicating a high level of impact. The EPSS score is less than 1 %, showing a low but non‑zero probability of exploitation in the near term, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is reflected XSS: an attacker can craft a URL or form input that the plugin will echo back to the browser, enabling script execution in the context of the user’s session. Successful exploitation would give the attacker the victim’s privileges and compromise confidentiality, integrity, or availability of the site’s data.*