The WP Go Maps WordPress plugin (WPGMaps) contains an improper input neutralization vulnerability that allows cross-site scripting (XSS) attacks. This affects all versions up to 9.0.29. The vulnerability enables an attacker to inject malicious scripts into web pages generated by the plugin, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 score is 7.1, reflecting network exploitability with low complexity and user interaction required. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS vector indicates that the attack requires user interaction but no privileges, and can be performed remotely over the network. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as disabling or limiting the use of the affected plugin, or implementing web application firewall (WAF) rules to detect and block XSS payloads targeting this plugin. Monitor vendor channels for updates.