The Mapster WP Maps plugin contains a stored cross‑site scripting flaw that can be exploited by an unauthenticated user. The vulnerability allows injection of arbitrary JavaScript into the loading_background_color configuration value because the REST save‑mapmaker endpoint lacks permission checks and the plugin fails to properly escape the value before rendering it in an inline style attribute. An attacker can exploit this to execute malicious code in the browsers of any visitor who loads the affected page, potentially compromising user accounts or defacing the site. This is an example of a classic XSS weakness (CWE‑79).

The flaw is present in the Mapster WP Maps WordPress plugin version 2.0.5 and earlier. Only sites that have these versions installed and the plugin active are affected. Upgrading to any newer release fixes the issue.

The vulnerability is publicly accessible because the REST endpoint authenticates no user and therefore can be abused by anyone on the Internet. The CVSS score of 7.2 indicates a high severity, but the EPSS score is unavailable so the exact likelihood of exploitation is unknown. The vulnerability is currently not listed in the CISA KEV catalog. Attackers would send a crafted JSON payload to the save‑mapmaker route, store a malicious script in the configuration, and that script would execute whenever a normal visitor loads a page that renders the shortcode.