The WP Google Maps Integration plugin allows unauthenticated users to inject arbitrary JavaScript through the "page" query parameter. Because the input is not adequately sanitized or escaped before being reflected back to the browser, an attacker can construct a malicious URL that, when clicked by an administrator, will execute the injected script in the admin context. This type of vulnerability may lead to cookie theft, session hijacking, defacement of the administration area, or further injection of malicious payloads into the site.

WordPress sites running Trapesium's WP Google Maps Integration plugin, all versions up to and including 1.2. Users of older or later versions are not affected.

The CVSS score of 6.1 indicates a moderate level of risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not be widely exploited yet. The attack vector is web‑based; it requires no authentication and only that an administrator run a crafted link, making it a relatively low‑effort technique for social engineering or phishing. Given the nature of XSS, successful exploitation could compromise administrator sessions or alter the site’s appearance.