Improper neutralization of user input during web page generation allows a malicious actor to persistently inject JavaScript payloads that run in the browsers of visitors to the compromised site. This stored XSS flaw can be used to steal session cookies, deface content, or execute arbitrary scripts that benefit an attacker. The vulnerability originates from the WP Google Street View plugin’s lack of input filtering when storing data in the database.

The Pagup WP Google Street View WordPress plugin is affected in all releases through version 1.1.5. Any WordPress installation that hosts this plugin and has not yet upgraded beyond 1.1.5 is vulnerable.

The CVSS score of 5.9 places the flaw in the medium severity range, while the EPSS score of less than 1% indicates a low probability of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web‑based interaction where an attacker submits malicious content that becomes stored in the site’s database and subsequently rendered to all users. No special authentication is required for injection, but the attacker must be able to influence the plugin’s data entry points.