The Best‑wp‑google‑map plugin contains a stored cross‑site scripting flaw caused by insufficient sanitisation of the ‘latitude’ and ‘longitudinal’ shortcode attributes. An attacker with Contributor or higher privileges can inject arbitrary JavaScript that will execute whenever a user loads a page containing the vulnerable shortcode, potentially enabling credential theft, session hijacking, or defacement. The weakness is a classic input validation flaw identified as CWE‑79.

The flaw is present in all versions of the Best‑wp‑google‑map WordPress plugin up to and including 2.1. No additional products or vendors are affected by this issue.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS value of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a role of Contributor or higher on the affected WordPress site, meaning the attack vector is insider or compromised legitimate user access rather than external unauthenticated compromise.