The Map My Locations plugin contains a flaw where user‑supplied attributes passed to the 'map_my_locations' shortcode are not properly sanitized or escaped. This allows an authenticated contributor or higher level user to inject arbitrary JavaScript into the shortcode. When a page containing the malformed shortcode is viewed, the injected script runs in the browser context of each visitor.

Affected WordPress sites that have the Map My Locations plugin by lewisking0072 installed in any version up to and including 1.1. The vulnerability is tied to the plugin's usage of the map_my_locations shortcode, which is rendered on pages or posts where site administrators have inserted it.

The CVSS base score of 6.4 indicates moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with contributor or higher permissions to edit a post or page that includes the map_my_locations shortcode, inject malicious attributes, and have another visitor load the affected page where the script executes.