Improper neutralization of input during web page generation allows a DOM‑based cross‑site scripting flaw in the Manoj Kumar MK Google Directions WordPress plugin. The flaw causes untrusted data supplied to the plugin to be rendered directly as JavaScript in the visitor’s browser, enabling arbitrary code execution in the site visitor’s context. This can lead to session hijacking, defacement, or malicious redirects. The weakness is a reflected XSS failure, classified as CWE‑79.

The vulnerability affects the MK Google Directions plugin for WordPress, developed by Manoj Kumar. All released versions from the initial release through version 3.1.1 are impacted; no later versions are mentioned in the advisory.

No CVSS score or EPSS value is published for this issue, but XSS vulnerabilities generally pose a moderate to high risk for confidentiality and integrity due to potential code execution in users’ browsers. The CVE is not listed in the CISA KEV catalog, indicating that widespread exploitation has not been documented. Based on the description, it is inferred that exploitation requires a victim to interact with crafted input—such as visiting a specially constructed URL or entering manipulated data—since the flaw is client‑side and depends on the plugin processing user‑supplied content.