A Cross‑Site Request Forgery issue in the Bas Matthee LSD Google Maps Embedder plugin allows an attacker who can trick an authenticated administrator into visiting a crafted URL to store malicious script data in the plugin’s settings. Because the data is rendered unfiltered on the site, the attacker can achieve persistent cross‑site scripting. This is classified as CWE‑352, which indicates a weakness in validating the origin of requests.

The vulnerability affects WordPress sites running the Bas Matthee LSD Google Maps Embedder plugin version 1.1 or earlier. No other vendors or products are listed as impacted.

The CVSS score of 7.1 reflects high impact, while the EPSS score of less than 1 % indicates a low likelihood of exploitation at the time of analysis. The issue is not included in the CISA KEV catalog. Exploitation requires the attacker to entice an administrator into executing a forged request; thus the attack vector is web‑based CSRF leading to stored XSS. If successful, the attacker can act on behalf of the site owner and potentially exfiltrate sensitive data or deface content.