Improper neutralization of input during web page generation enables a DOM‑based cross‑site scripting flaw in the Manny Costales GMap Shortcode plugin. Input supplied to the plugin’s shortcode can be rendered without proper escaping, allowing a crafted value to be injected into the page’s DOM and executed as JavaScript within the context of the site. This can expose user credentials, perform actions on behalf of the user, or alter page content.

The vulnerability affects all releases of the WordPress GMap Shortcode plugin produced by Manny Costales that are version 2.0 or earlier. Sites still running those releases are susceptible.

With a CVSS base score of 6.5, the flaw represents a moderate security issue. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require an attacker to supply a crafted shortcode parameter to a publicly accessible WordPress page; the attack vector is therefore local to the website operator or a content author with shortcode privileges.