The Google Maps for WordPress plugin contains an improper neutralization of input during web page generation, resulting in a DOM-based cross‑site scripting flaw. This weakness allows a remote attacker to deliver arbitrary client‑side script code that is executed in the victim’s browser when the plugin renders a map or injects data, potentially compromising the integrity of the displayed content.

Versions of the Google Maps for WordPress plugin distributed by Aaron D. Campbell up to and including 1.0.3 are affected.

The CVSS score of 6.5 classifies the vulnerability as moderate severity. The EPSS score of less than 1% indicates a very low but nonzero likelihood of exploitation in the wild, and the flaw is not referenced in CISA’s KEV catalog. Based on the description, the likely attack vector is a DOM‑based XSS where malicious input is not properly sanitized and is reflected back to the browser when the plugin generates content.