Cross‑Site Request Forgery in the ryan_xantoo Map Contact plugin allows an attacker to store malicious JavaScript in the plugin’s data. When a visitor loads the contact map, the stored script is rendered, leading to arbitrary script execution in the victim’s browser. The weakness is identified as CWE‑352.

WordPress sites that use the ryan_xantoo Map Contact plugin version 3.0.4 or earlier are affected. No other WordPress components are mentioned, so the impact is limited to installations that have not upgraded beyond 3.0.4.

The CVSS score of 7.1 indicates a high severity level. The EPSS score of less than 1 % suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog, indicating no widespread public exploitation. The likely attack path is via a crafted HTTP request that bypasses CSRF checks, enabling the stored XSS to be activated when the map is viewed.