The vulnerability is an unauthenticated Cross Site Scripting flaw in the MapPress Maps for WordPress plugin versions 2.97.3 and earlier. It allows an attacker to inject arbitrary JavaScript or malicious content into web pages that load the plugin. This can expose sensitive data or perform unintended actions when site visitors load the affected pages, because the code runs in the context of the victims' browsers. The weakness is caused by insufficient sanitization of user‑supplied input, as classified by CWE‑79.

The issue affects installations of the MapPress Maps for WordPress plugin developed by Chris Richardson. All sites running version 2.97.3 or older of the plugin are vulnerable.

The CVSS score of 7.1 indicates a high severity, reflecting that unauthenticated attackers can exploit the flaw without additional access. The EPSS score is not available, so the exact exploitation likelihood is unknown, and the KEV status shows no confirmed widespread exploitation. The likely attack vector is through crafted URLs or input fields that the plugin processes without proper filtering, enabling attackers to embed malicious scripts that run in the browsers of all site visitors.