The vulnerability is a stored cross‑site scripting flaw (CWE‑79) in the Posts map plugin, caused by insufficient sanitization of the "name" shortcode attribute. An attacker who holds contributor or higher privileges can submit content containing malicious scripts that are persisted and rendered on page load, leading to code execution in the browsers of all users who view the affected page.

The issue affects the Posts map WordPress plugin developed by lucdecri, with all releases up to and including version 0.1.3. Users who have installed these or earlier versions are at risk if they grant contributor or higher access to the site.

The vulnerability scores a CVSS of 6.4, indicating moderate severity. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog, suggesting limited public exploitation data. Nevertheless, exploitation requires only authenticated access with contributor or higher role, which is commonly assigned for content management. An attacker can exploit the flaw by creating or editing a post that uses the "name" attribute, causing the stored script to run whenever any user visits the page. Because the payload runs in the user's browser, it can lead to theft of session cookies, defacement, or further compromise of the victim's system.