An unauthenticated Cross Site Scripting vulnerability exists in WordPress Ultimate Maps by Supsystic versions 1.5.5 and older. The flaw allows an attacker to inject arbitrary script code that is executed in the browser of any user who views a page that renders the plugin’s output. This can be used to modify site content, steal session cookies, redirect users, or execute further malicious actions within the victim’s session.

WordPress sites that have installed the Ultimate Maps by Supsystic plugin version 1.5.5 or earlier are affected. The vulnerability is tied to the Supsystic vendor’s plugin and does not impact other WordPress components directly.

The CVSS score of 7.1 classifies this flaw as high severity, indicating a significant exploitation risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because exploitation requires no authentication, the likely attack vector is any user visiting a vulnerable page, which could allow attackers to exploit thousands of unpatched sites worldwide.