This vulnerability (CVE-2024-21744) in Mapster WP Maps involves improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). It allows stored XSS attacks where malicious scripts can be injected and executed in the context of users viewing the affected pages. The vulnerability affects all versions up to 1.2.38. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low and low respectively. No vendor advisory or patch is currently available, and the product is not a cloud service.

Successful exploitation can lead to execution of arbitrary scripts in the context of users interacting with the vulnerable plugin, potentially resulting in information disclosure, data manipulation, or denial of service. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting privileges of users who can input data into the plugin and apply web application firewall (WAF) rules to detect or block XSS payloads related to this plugin. Monitor vendor channels for updates and apply patches promptly once available.