Stored Cross‑Site Scripting exists in the WP Maps plugin for WordPress. An authenticated user with subscriber or higher privileges can send a request containing malicious code in the shapes_values parameter. The input is not properly sanitized or escaped, causing the code to be stored and later executed in the context of any visitor who views the injected page. This flaw enables attackers to compromise the browser context of unsuspecting users, potentially allowing session hijacking, defacement, or the execution of arbitrary scripts. The vulnerability stems from CWE‑79.

The flaw affects the Flippercode WP Maps plugin, which integrates Google Maps, OpenStreetMap, Mapbox, and store locator functionality. All plugin releases up to and including 4.9.8 are vulnerable. Users who have subscriber‑level access or higher can exploit the issue. Anyone who can view a map page on a site running a vulnerable version is susceptible to the consequences of the stored code.

The baseline CVSS score is 6.4, indicating moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires authentication as a subscriber or higher, but the nonce used by the drawing endpoint (fc‑call‑nonce) is exposed through the global object window.wpgmp_local.nonce, allowing the attacker to read it. Additionally, the secondary _wpnonce check can be bypassed by omitting the parameter. Once the request is crafted, the malicious script is persisted in the database and executed whenever a visitor loads the affected map page. No code execution on the server is required, so the primary impact is the compromised browser environment of the site visitors.