The vulnerability arises from an Improper Restriction of XML External Entity Reference that lets an attacker inject arbitrary XML into the Easy Google Maps plugin. A crafted XML payload can cause the plugin to dereference external entities, exposing sensitive files, leaking system information, or potentially executing remote code if the XML processing allows it. This weakness aligns with CWE‑611.

The issue affects WordPress sites running the Easy Google Maps plugin developed by supsystic in all releases up to and including version 1.11.18. Any WordPress installation that has installed this plugin within that version range is vulnerable.

The CVSS score of 6.6 classifies this as a medium‑severity vulnerability, and the EPSS score of less than 1 % indicates a very low but non‑zero probability of exploitation in the wild. Because the flaw is triggered by XML injection, the attack vector is likely through crafted input that reaches the plugin—such as a publicly exposed form or malicious content uploaded by a user. The absence from the KEV catalog means no publicly known exploits are documented, yet the potential for data exfiltration or remote code execution still warrants prompt remediation.