The Coon Google Maps plugin for WordPress suffers from a stored XSS vulnerability due to insufficient input sanitization and output escaping of the 'height' parameter within the 'map' shortcode. This flaw allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript code into pages, which executes in the context of users viewing those pages. The vulnerability affects all versions up to and including 1.0. The CVSS 3.1 score of 6.4 reflects a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with contributor-level access can exploit this vulnerability to inject persistent malicious scripts into pages, potentially leading to unauthorized actions performed in the context of other users viewing the infected pages. The impact includes partial confidentiality and integrity loss but does not affect availability. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Coon Google Maps plugin if feasible to reduce exposure.