WP‑Ultimate‑Map, a WordPress plugin, has a missing nonce validation on the process_init() function hooked to admin_init (CWE‑352). This flaw allows an attacker to send a forged POST request that overwrites plugin options, such as the zoom‑level setting, without authentication. Because the value of zoom‑level is stored unsanitized and later echoed directly into an HTML attribute and inline JavaScript on the settings page, the attacker can inject arbitrary scripts that execute in the context of any site administrator who subsequently loads that settings page.

All installations of WP‑Ultimate‑Map version 1.1 and earlier are vulnerable. The plugin is distributed by developer rahulbhangale and is commonly deployed on public WordPress sites that rely on the mapping feature, so any site running an affected version is at risk if the plugin remains installed.

The flaw carries a CVSS score of 6.1, indicating moderate severity, and has no EPSS score available at this time. It is not listed in the CISA KEV catalog. Exploitation requires the attacker to trick an administrator into loading a crafted link— a typical CSRF social‑engineering scenario—after which the injected script executes with the privileges of that administrator when the settings page is rendered.