The vulnerability CVE-2024-43224 in Yuri Baranov's YaMaps for WordPress plugin is a stored Cross-site Scripting (CWE-79) flaw caused by improper input sanitization during web page generation. This allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can execute in the context of other users, potentially leading to information disclosure, session hijacking, or other impacts. The affected versions include all versions up to 0.6.27. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability at a low level. No vendor advisory or patch information is currently available.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting the affected WordPress site. This may lead to limited confidentiality, integrity, and availability impacts such as theft of user credentials, session tokens, or manipulation of site content. The attack requires user interaction and low privileges, which somewhat limits the scope but still poses a meaningful risk to site users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider restricting user input capabilities, applying web application firewall (WAF) rules to detect and block XSS payloads, and monitoring for suspicious activity related to the plugin. Avoid granting unnecessary privileges to users who can input data into YaMaps. Do not rely on generic mitigations without vendor confirmation.