The esri‑map‑view plugin for WordPress contains a Stored Cross‑Site Scripting vulnerability that allows authenticated users with contributor level permissions or higher to inject arbitrary JavaScript through the plugin’s shortcode. The weakness lies in insufficient input validation and output escaping on user supplied attributes, enabling the attacker to place malicious scripts into page content that will run whenever a visitor loads the page. As a result the attacker could hijack sessions, deface websites, or exfiltrate data from victim browsers.

This issue affects the geoplay9 esri‑map‑view WordPress plugin in all versions up to and including 1.2.3. Users who have installed those versions and have contributor or higher roles are vulnerable.

The CVSS score of 6.4 indicates a moderate severity, but the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, further implying that it has not yet attracted notable exploits. Because the attack requires authenticated contributor access, the threat surface is limited to sites that allow users to add or edit content, but within that scope the risk of compromised user sessions and data theft remains real.