An unauthenticated Cross Site Scripting (XSS) vulnerability exists in versions of the Mapster WP Maps WordPress plugin 2.0.4 and earlier. The flaw results from improper handling of user-supplied input, allowing the injection of arbitrary JavaScript that will be executed in the browser when a page containing a vulnerable map is viewed. Successful exploitation can lead to defacement, cookie theft, or further malware delivery, compromising the confidentiality, integrity, and availability of the site.

The affected vendor is Mapster, and the product is the Mapster WP Maps plugin for WordPress. Any installation running the plugin version 2.0.4 or any earlier minor release is vulnerable. The issue was addressed in version 2.0.5; installing that or later versions removes the flaw.

The CVSS base score of 7.1 indicates moderate severity, and the EPSS score of <1% indicates an extremely low likelihood of exploitation. No KEV listing is available, suggesting no publicly known exploitation campaigns. Because the vulnerability is client‑side and unauthenticated, an attacker can craft a malicious payload without credentials, typically by injecting script into the map shortcode or via a public URL. The low barrier to exploitation combined with the popularity of WordPress means this vulnerability is a high‑priority patch issue.