The Google Maps GPX Viewer plugin for WordPress contains an input handling flaw that improperly neutralizes user supplied data. When a maliciously crafted URL is requested, the plugin reflects the supplied value back into the generated web page without escaping it, creating a reflected cross‑site scripting (XSS) vulnerability. This enables an attacker to inject and execute arbitrary client‑side scripts in the browser of any user who opens the page, potentially allowing cookie theft, session hijacking or other site‑wide attacks.

All releases of the Bernd Altmeier Google Maps GPX Viewer plugin from the earliest available version through version 3.6 are affected. The plugin is installed on WordPress sites that use it to display GPX tracks and maps.

The flaw receives a CVSS score of 7.1, indicating high severity, and an EPSS score of less than 1 %, suggesting low exploitation probability. It is not listed in the CISA KEV catalog. The vulnerability is a reflected XSS, so an attacker can exploit it remotely by luring a user to visit a crafted link or embedding the malicious payload in a phish or social‑engineering scenario. No authentication or privileged access is required for exploitation.