This vulnerability in the Ydesignservices Multiple Location Google Map plugin allows an attacker to exploit CSRF to inject stored XSS payloads. The affected versions are from initial releases through version 1.1. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction, and it impacts confidentiality, integrity, and availability to a limited extent. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation could allow an attacker to execute stored cross-site scripting attacks via CSRF, potentially leading to limited confidentiality, integrity, and availability impacts on affected systems using the vulnerable plugin. The CVSS score of 7.1 reflects a high severity but not critical. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider disabling or removing the vulnerable plugin or implementing CSRF protections and input sanitization where possible to mitigate risk.