CVE-2026-4268 is a stored cross-site scripting vulnerability in the WP Go Maps WordPress plugin (up to version 10.0.05). It is caused by improper neutralization of input in the 'wpgmza_custom_js' parameter due to insufficient sanitization and escaping, and lack of capability checks in the 'admin_post_wpgmza_save_settings' hook anonymous function. This allows authenticated users with at least Subscriber privileges to inject malicious JavaScript that executes in the context of other users viewing the injected pages. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). There is no vendor advisory or patch link available at this time.

An attacker with authenticated access at Subscriber level or above can inject stored malicious scripts into pages via the vulnerable parameter. These scripts execute when other users access the affected pages, potentially leading to partial confidentiality and integrity loss (e.g., theft of session tokens or manipulation of page content). Availability is not impacted. The vulnerability affects the confidentiality and integrity of users interacting with the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and consider disabling or limiting the use of the affected plugin. Monitor for updates from the vendor and apply patches promptly once released.