CVE-2026-13179 is a stored cross-site scripting vulnerability in the WP Maps plugin for WordPress, affecting all versions up to and including 4.9.8. The flaw is due to improper neutralization of input in the shapes_values parameter, allowing authenticated users with subscriber-level privileges or higher to inject arbitrary web scripts. The vulnerability is exacerbated by the exposure of the fc-call-nonce to all frontend visitors and the ability to bypass a secondary nonce check by omitting the _wpnonce parameter. This enables attackers to execute scripts in the context of users viewing the injected pages.

An attacker with subscriber-level access or higher can inject persistent malicious scripts into pages rendered by the plugin. These scripts execute in the context of users who view the affected pages, potentially leading to theft of sensitive information, session hijacking, or other client-side attacks. The vulnerability does not require user interaction beyond viewing the injected page and does not impact availability. The CVSS 3.1 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required.

No official patch or fix is currently referenced in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to the plugin. Avoid exposing the plugin to untrusted users. Follow vendor updates closely for an official fix.