The vulnerability is an unauthenticated Cross‑Site Scripting flaw in the Ultimate Maps by Supsystic WordPress plugin below version 1.5.0. A malicious user can inject arbitrary JavaScript into pages rendered by the plugin, allowing the execution of scripts in the context of any visitor who views the affected content. This can lead to credential theft, session hijack, or defacement of the site. The weakness is a classic input validation failure, classified as CWE‑79.

The flaw affects all installations of the Ultimate Maps by Supsystic WordPress plugin with a version lower than 1.5.0. The plugin is developed by Supsystic and is used in WordPress environments for mapping and location‑based content. The vulnerability exists regardless of the specific WordPress theme or other plugins, as long as the vulnerable plugin is active.

The CVSS base score of 7.1 indicates a moderate to high risk, and because the attack does not require authentication an attacker only needs to send crafted requests to the site. Although no EPSS value is provided, the lack of authentication requirement implies a high exploitation probability. The vulnerability is not currently listed in CISA KEV. An attacker can exploit it via HTTP requests to the plugin’s endpoints, inserting script payloads that are reflected or stored in the map configuration. The impact is site‑wide exposure of visitor browsers, making patching a priority.