The GMap Generator plugin contains a stored cross‑site scripting flaw that exploits the unfiltered ‘h’ parameter. An authenticated user with Contributor or higher privileges can inject JavaScript into a page that persists in the database, causing it to execute whenever any user loads that page. This allows the attacker to run code in the context of site visitors, potentially hijacking sessions, defacing content, or exfiltrating data.

WordPress sites that install prabode’s GMap Generator plugin with versions 1.1 or earlier. The vulnerability exists in all releases up to and including 1.1. Users running any of these versions are at risk. The plugin is a front‑end component for rendering Google Maps and is active on any site that has installed it.

The flaw carries a moderate CVSS score of 6.4 and an EPSS score of less than 1 %, indicating a low likelihood of widespread exploitation. It is not currently tracked in the CISA KEV catalog. Because the attack requires only Contributor‑level access, any site that allows contributors to install or modify pages could be compromised. Exploitation is straightforward: the attacker logs in, submits a malicious script via the ‘h’ field, and the data is stored until a visitor loads the page.