The Simple Google Static Map plugin version 1.0.1 and earlier suffers from a DOM-based Cross-site Scripting vulnerability due to improper input neutralization during web page generation. This vulnerability can be exploited remotely over the network with low attack complexity and requires user interaction. Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user session. The CVSS 3.1 base score is 6.5, reflecting medium severity. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, modification of data, or disruption of service. The impact is limited by the need for user interaction and low privileges required by the attacker. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider minimizing exposure by restricting access to the vulnerable plugin or disabling it if feasible. Monitor vendor channels for updates regarding patches or official mitigations.