The Flexible Map plugin’s shortcode stored user input without adequate sanitization or escaping, enabling authenticated users with contributor-level privileges to insert arbitrary web scripts into pages. This stored cross‑site scripting flaw permits injected code to execute in the browsers of any visitor to the compromised page, potentially leading to credential theft, session hijacking, or phishing attacks. The weakness corresponds to CWE‑79, reflecting improper output encoding.

WordPress sites using the webaware Flexible Map plugin version 1.18.0 or earlier are vulnerable. Only users who have contributor or higher privileges can exploit the flaw by adding or editing content that includes the shortcode with malicious attributes. Site administrators should verify which variants of the plugin are deployed and whether the affected versions are present.

The recorded CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the foreseeable future. This vulnerability is not listed in the CISA KEV catalog, implying it has not yet been observed in widespread misuse. Exploitation requires authenticated access with at least contributor permissions, making the attack vector somewhat constrained but still significant for sites that allow contributors to add or edit content. The overall risk to a site depends on the trust level assigned to contributors and the presence of the plugin’s shortcode in publicly accessible pages.