The Mihdan: Elementor Yandex Maps plugin for WordPress is vulnerable to stored cross‑site scripting through its block attributes. When a contributor‑level or higher user adds or edits a map block, the plugin does not sanitize or escape the marker pin data that contains user input. As a result, JavaScript or other malicious payloads can be stored in the database and will be injected into any page that renders the map. This flaw can be leveraged to steal session cookies, deface content, or execute arbitrary actions on behalf of any visitor who views the affected page.

All WordPress installations that use the Mihdan: Maps from Yandex for Elementor plugin version 1.6.11 or earlier. Sites that allow contributors or higher roles to create or edit map blocks are at risk. The vulnerability exists before and including 1.6.11; newer releases have addressed it.

The CVSS score of 6.4 indicates moderate risk for potential impact. The EPSS score is less than 1%, suggesting that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with contributor-level permissions or higher; the attacker must submit a malicious marker pin through the block editor. Once injected, the payload will execute whenever any user loads the page that contains the compromised map block.