The AB Google Map Travel plugin contains a Cross‑Site Request Forgery weakness that permits an attacker to forge requests under the identity of an authenticated user. Because the supplied post data is not properly validated, the forged request can insert arbitrary JavaScript into the website’s database. When the malicious content is later displayed, the stored script executes in the browsers of all site visitors, creating a persistent Cross‑Site Scripting condition that can be used to steal credentials, hijack sessions, or deface the site.

WordPress sites running the AB Google Map Travel plugin from the earliest released version through 4.6 inclusive are affected. The vendor, Aboobacker, is responsible for this plugin.

The indexer assigned a CVSS score of 7.1, marking the issue as high severity. Its EPSS score is less than 1%, indicating that active exploitation is sparse at this time, and it is not listed in the CISA KEV catalog. The likely attack vector is a high‑impact CSRF that requires an authenticated administrator or privileged user to submit the forged request. Once triggered, the stored script can execute on every visitor’s browser, producing significant confidentiality and integrity risks.