CVE-2026-13335 describes a stored cross-site scripting vulnerability in the CodePeople Post Map for Google Maps plugin for WordPress. The issue is due to improper neutralization of input during web page generation, specifically in the 'cpm_point' post meta field. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary scripts that execute in the context of users viewing the injected pages. This vulnerability affects all plugin versions up to and including 1.2.6. The CVSS 3.1 base score is 6.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no impact on availability. No official patch or remediation guidance has been provided by the vendor as of the published date.

The vulnerability allows authenticated users with Contributor-level access or above to inject malicious scripts into pages via the 'cpm_point' post meta. These scripts execute in the browsers of users who visit the affected pages, potentially leading to unauthorized actions or data disclosure within the context of the affected site. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the affected plugin. Monitor for updates from the vendor regarding patches or official mitigations.