The vulnerability is an improper neutralization of user input during page rendering that lets an attacker inject and execute arbitrary JavaScript in a victim’s browser. A successful exploit can result in defacement, cookie theft, or session hijacking, compromising confidentiality, integrity, and availability of the site for the affected user. The weakness is a classic input validation failure catalogued as CWE‑79.

The flaw is present in the MapGeo Interactive Geo Maps WordPress plugin in all releases up to and including version 1.6.24. Any WordPress site that has a vulnerable version installed is at risk.

The CVSS score of 7.1 indicates a high severity, yet the EPSS score of less than 1% shows exploitation attempts are currently rare. Based on the description, it is inferred that the likely attack vector is a malicious URL containing query parameters that are reflected back into the page, and an attacker could also entice a user to visit such a link or exploit a CSRF context to trigger the code. The vulnerability is not listed in the CISA KEV catalog, which suggests a lower public awareness of active attacks at this time.