Improper neutralization of input during web page generation allows attackers to inject arbitrary JavaScript into pages served by the Highwarden Super Interactive Maps WordPress plugin. This reflected XSS can execute in a user’s browser when the user visits a crafted URL, enabling potential cookie theft, session hijacking, or page defacement. The flaw is classified as CWE‑79, and the CVSS score of 7.1 indicates a high severity.

Highwarden’s Super Interactive Maps WordPress plugin is affected in all releases up to and including version 2.3. Anyone using any of those plugin versions on a publicly accessible site is at risk. The plugin renders map content directly in the front‑end, so the vulnerability is reachable through the normal user interface.

The EPSS score of less than 1% suggests that widespread exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector appears to be a reflected XSS via a URL parameter; a malicious link can be embedded in, for example, a search field or a shared page. When a user visits the crafted link, the injected script runs in the context of the victim’s browser, potentially compromising credentials or other sensitive information.