The vulnerability allows authenticated users with Contributor level or higher to insert arbitrary JavaScript into stored content because the plugin does not properly sanitise user input or escape output. When another user views the affected page, the injected script runs in that user’s browser, giving the attacker control of the victim session.

WordPress sites that have installed any version of the PeproDev Branches Map (Mapify) plugin up to and including 3.0.1 are affected. The plugin is distributed by peprodev and can be downloaded from the WordPress plugin repository. Any WordPress installation that includes a vulnerable instance is at risk.

The CVSS score of 6.4 indicates moderate severity, while the EPSS <1% suggests a low probability of exploitation at present. The flaw is not listed in CISA’s KEV catalog. An attacker must be authenticated with Contributor privileges or higher to exploit the issue, after which the injected scripts execute when an end user visits the page. The description does not mention server‑side compromise or database access, so the impact is limited to front‑end script execution.