Key detail from the description: the WP Go Maps plugin allows authenticated attackers with Subscriber-level access and above to inject arbitrary scripts via the wpgmza_custom_js parameter when the admin_post_wpgmza_save_settings hook is triggered. The injected scripts execute in any user’s browser when they view a page that contains the malicious content. The impact is typical of stored XSS attacks, potentially enabling session hijacking, defacement, or delivery of malicious payloads. The weakness is categorized as CWE‑79, due to insufficient input sanitization and output escaping.

The affected product is WP Go Maps (formerly WP Google Maps) for WordPress. All plugin versions up to and including 10.0.05 are vulnerable. No specific CPE strings are provided, but the plugin is used on WordPress sites; any site running a vulnerable version is at risk.

The CVSS base score is 6.4, indicating medium severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only authenticated access at the Subscriber level or higher, because the plugin lacks a proper capability check. An attacker can navigate to the plugin’s settings page, insert malicious script into the custom JS field, and submit the form, causing that script to be stored and served to all users who view the affected page. No public exploit has been observed, but the flaw is present in a widely used plugin.