The Maps for WP plugin includes a stored cross‑site scripting flaw caused by improper neutralization of input that is rendered on web pages. When an attacker can insert JavaScript or other executable code into data fields that are subsequently displayed to other users, the attacker can execute arbitrary script in the browser of any user who views the affected content. This may compromise user credentials, facilitate phishing, or spread malware, impacting confidentiality and integrity of the site’s users.

The vulnerability exists in icopydoc’s Maps for WP plugin, versions from the first release up to and including 1.2.4. Any WordPress installation that has this plugin installed and is using a version 1.2.4 or older is potentially affected.

The CVSS score of 6.5 indicates a moderate‑to‑high severity. The EPSS score of less than 1 % suggests that exploitation is currently rare, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the plugin’s data entry interfaces where an attacker can store malicious payloads that are later rendered; the exploit requires write access to the plugin’s data storage, so an attacker might need a user account with sufficient privileges or a way to submit data via a public form.