Improper neutralization of input during page generation allows DOM‑based XSS on sites using MiKa OSM, enabling a malicious actor to inject and execute scripts in the browsers of site visitors. Based on the description, it is inferred that this may allow theft of session cookies, defacement, or redirection to malicious sites. This weakness is a classic input validation error captured by CWE‑79.

The affected product is the MiKa OSM WordPress OpenStreetMap plugin, version 6.1.13 and any earlier release. All installations running any prior version are potentially vulnerable until the plugin is updated beyond 6.1.13.

The CVSS score of 6.5 indicates a moderate risk level. The EPSS score is below 1%, implying a low probability of widespread exploitation at this time, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack path is inferred to be through crafted URLs or form input that reaches the plugin’s DOM manipulation code, and it can be executed without authentication on any user who visits the affected page.