The CBX Map for Google Map & OpenStreetMap plugin contains a DOM‑Based XSS flaw caused by improper neutralization of user input during page generation. An attacker can inject arbitrary JavaScript that runs in the context of a victim’s browser, potentially allowing cookie theft, session hijack, or defacement of the site.

Sabuj Kundu’s CBX Map for Google Map & OpenStreetMap plugin is vulnerable in all releases up to and including version 1.1.12. This includes any site that has installed the plugin without upgrading beyond that version.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to lure a user to a page served by the plugin or exploit an admin interface that processes untrusted input, implying that a remote attacker could exploit the flaw by simply directing a victim to a crafted URL or loading malicious content through the plugin’s features.