The WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator, Listing, Directory & Filters plugin contains a stored XSS flaw in the 'location_messages' parameter. Because the input is not properly sanitized or escaped, an attacker with administrative or higher privileges can inject JavaScript into the plugin’s data store. When a victim loads a page containing the injected message, the malicious script runs in the victim’s browser, potentially stealing session cookies, manipulating the UI, or executing further attacks.

All installations of the WP Maps plugin up through version 4.9.4 running on WordPress are affected. The vulnerability applies to the version history of the plugin published on the WordPress plugin repository and the version released to the public, with no specific revisions listed beyond the overall upper bound of 4.9.4.

The CVSS score of 4.4 indicates moderate severity, but the necessity of administrative access limits the potential impact to sites where attackers can obtain or abuse elevated privileges. The EPSS score is not available, and the vulnerability is not catalogued in CISA’s KEV database. Based on the description, the attack vector is local to the WordPress environment: an authenticated user with the custom "wpgmp_manage_location" capability (typically admins or roles granted this capability via the plugin’s Permissions screen) can create or modify a location message to embed malicious script. Once stored, every visitor to the affected page will be exposed to the injected code.