CVE-2026-39674 describes a DOM-based Cross-site Scripting vulnerability in the MK Google Directions plugin (versions up to 3.1.1) by Manoj Kumar MK. The vulnerability is due to improper neutralization of input during web page generation, which can lead to execution of malicious scripts in the user's browser. The CVSS 3.1 score is 6.5, indicating a medium severity issue with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No patch or official remediation guidance is currently available from the vendor. The vulnerability is not related to a cloud service and no known exploits have been reported.

An attacker with low privileges and requiring user interaction could exploit this DOM-based XSS vulnerability to execute arbitrary scripts in the context of the affected web application. This can lead to limited confidentiality, integrity, and availability impacts such as theft of user data, session hijacking, or manipulation of web content. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and consider applying any available temporary mitigations recommended by the vendor. Monitoring for updates from the vendor is advised.