The GmapsMania plugin for WordPress contains a stored cross‑site scripting flaw caused by insufficient sanitization and escaping of attributes supplied to the gmap shortcode. Attackers with authenticated contributor‑level access can insert arbitrary web scripts into the shortcode. Those scripts are written to the WordPress database and then rendered unescaped whenever a user views a page that contains the shortcode. The stored XSS permits the attacker to execute client‑side code in the browsers of any visitor to the affected page.

All users of the garubi GmapsMania WordPress plugin running version 1.1 or earlier are affected. The flaw is resolved in releases newer than 1.1. Sites that have not yet applied the patch or have not upgraded to a later version remain vulnerable. The vulnerability requires the attacker to have at least Contributor role or higher to add or edit content containing the shortcode.

The CVSS score of 6.4 reflects a moderate severity. The EPSS score is below 1 %, indicating a very low current probability of exploitation. The flaw is not listed in the CISA KEV catalog. Because the attack vector requires authenticated contributor access, the initial exploitation is limited to users with sufficient privileges. However, once a payload is stored, every visitor to the affected page will have the script executed on their browser.