The vulnerability is an Improper Neutralization of Input During Web Page Generation that enables DOM‑Based Cross‑Site Scripting in the 100plugins Open User Map plugin for WordPress. An attacker can inject malicious JavaScript that will run in the browsers of any user who opens a page containing the flaw, potentially allowing manipulation of the page or exfiltration of data from the victim’s session. The description does not specify particular consequences beyond script execution, but the impact is consistent with typical XSS risks.

WordPress sites running the Open User Map plugin from the 100plugins vendor are affected. All installations with a plugin version from the initial release up to and including 1.4.14 require remediation.

The CVSS score of 6.5 reflects a moderate to high potential impact. The EPSS score is less than 1 %, indicating a low probability of current exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is inferred to be a crafted URL or input that the plugin reflects in the DOM without proper sanitization, enabling DOM‑based XSS.