The Meks Easy Maps plugin for WordPress is vulnerable to stored cross‑site scripting because the title field of a map post is not properly sanitized or escaped before being rendered. An authenticated attacker with contributor or higher privileges can save a malicious script in the post title, causing the script to execute in the browser of any user who views the map. This allows the attacker to steal session cookies, deface pages, or launch secondary phishing attacks, all without requiring server‐side code execution.

All WordPress sites that have the Meks Easy Maps plugin installed at version 2.1.4 or earlier are affected. The vulnerability exists regardless of the WordPress core version, as long as the plugin is present and a contributor or higher user can modify a map post.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests that, as of now, exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog, and there are no publicly reported exploits. Attackers must first authenticate to the WordPress admin area and possess at least contributor privileges, after which they can inject the malicious payload into the title field. Once the payload is stored, any user who opens the map will trigger its execution. The risk escalates if the site has numerous contributor accounts or if the site is publicly accessible to attackers who can obtain credentials, but without those prerequisites the exposure is limited.