The Norbert Slick Google Map plugin contains a cross‑site request forgery flaw that allows an attacker to submit a crafted request on behalf of a logged‑in user, resulting in the plugin storing malicious JavaScript. Once stored, the script executes in the context of any visitor to the affected page, enabling attackers to hijack sessions, deface content, or launch further attacks.

The vulnerability affects the Slick Google Map WordPress plugin from Norbert, versions up to and including 0.3.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% shows an extremely low but non‑zero likelihood of exploitation. The flaw is not currently listed in CISA’s KEV catalog. Attacks are remote, leveraging a CSRF vector that requires the attacker to trick a victim into sending a request to the plugin’s endpoint. Successful exploitation results in stored XSS, which confidentiality, integrity, and availability of the site’s users.