The flaw is a DOM-based Cross‑Site Scripting (XSS) vulnerability that enables an attacker to inject arbitrary client‑side scripts into pages rendered by the MK Google Directions plugin. Because the plugin fails to properly neutralize user input, malicious code can execute in the victim’s browser, potentially leading to credential theft, session hijacking, defacement or other client‑side attacks. The weakness is a classic XSS issue, classified as CWE-79.

The vulnerability affects the Manoj Kumar MK Google Directions WordPress plugin for all releases up to and including version 3.1.1. No data exist for versions beyond that boundary, so site owners using any of these releases remain exposed until an updated version is applied.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the likely attack vector involves a victim visiting a page containing crafted plugin input or a malicious link; no server-side compromise or special privileges are required, making the risk primarily to site visitors who load the vulnerable plugin.