The vulnerability is a DOM‑based XSS flaw in the RomanCode MapSVG plugin that allows an attacker to inject malicious JavaScript into web pages rendered by the plugin. This can lead to theft of session cookies, defacement of content, or drive‑by compromise of site visitors. The weakness is identified as CWE‑79 and is noted to affect all releases up to version 8.7.22.

The affected component is the WordPress plugin MapSVG (mapsvg‑lite‑interactive‑vector‑maps) provided by RomanCode, available in all versions prior to and including 8.7.22. No specific OS or server configuration is listed, but any WordPress installation deploying this plugin is at risk.

The CVSS score is 6.5, indicating moderate impact. The EPSS score is less than 1%, suggesting that real‑world exploitation is unlikely at this time, and the vulnerability is not present in the CISA KEV catalog. Attackers would need to trick a user into interacting with a crafted URL or page that loads the plugin’s data; the flaw is entered client‑side and does not require privileged access. The absence of a remote code execution vector keeps the risk lower, but because XSS can be leveraged for credential theft or phishing, administrators should treat it with caution.