The WP Map Plugins Interactive US Map plugin suffers from a CSRF vulnerability that enables stored XSS attacks. This affects all versions up to 2.7. The vulnerability allows an attacker to trick an authenticated user into submitting a forged request, which results in malicious script storage and potential execution in the context of the victim's browser. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of affected users, potentially leading to session hijacking, defacement, or other malicious actions. The CSRF aspect means attackers can induce authenticated users to perform unintended actions. The combined impact affects confidentiality, integrity, and availability to a limited extent as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Interactive US Map plugin or restricting its usage to trusted users only. Implementing web application firewall (WAF) rules to detect and block CSRF attempts may provide temporary mitigation. Monitor vendor channels for updates and apply patches promptly once released.