The Mapster WP Maps plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts into pages via multiple input fields. These scripts execute in the context of users viewing the affected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects versions up to 1.20.0. There is no vendor advisory or patch available at this time.

Successful exploitation allows an authenticated user with contributor-level permissions or higher to inject and execute arbitrary JavaScript in the context of other users viewing the infected pages. This can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability does not affect availability and requires user interaction (page access) to trigger the payload. The CVSS score of 6.4 reflects a medium severity impact with low complexity and privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level access to trusted users only and consider disabling or removing the Mapster WP Maps plugin if possible. Monitor for plugin updates from the vendor that address this vulnerability.