The Bon Toolkit plugin’s bt‑map shortcode contains a stored cross‑site scripting flaw that allows an authenticated user with contributor‑level permissions to insert arbitrary JavaScript into the page content. The injected code is saved to the database and is rendered to every visitor who loads a page that contains the shortcode, leading to persistent client‑side script execution. This vulnerability is a classic example of a CWE‑79 weakness caused by insufficient input validation and output escaping.

All WordPress installations that include Bon Toolkit version 1.3.2 or earlier and have enabled the bt‑map shortcode are affected. The flaw requires an account with contributor or higher privileges to add or edit content containing the shortcode; therefore, any site that allows such contributors to modify posts or pages where the shortcode may appear is vulnerable.

With a CVSS score of 6.4 the issue is classified as moderate severity, and an EPSS score of less than 1 % indicates a low current exploitation probability. The attack vector is inferred to be the use of the provided shortcode by a contributor who can edit content; an attacker who compromises or is granted such credentials can persist malicious scripts that run for all site visitors until the plugin is updated or the content is sanitized. The CVE is not listed in the CISA KEV catalog.