CVE-2026-57670 is an unauthenticated cross-site scripting (XSS) vulnerability in Codepeople Google Maps CP plugin versions <= 1.2.5. The issue arises from improper neutralization of input during web page generation, classified under CWE-79. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes partial loss of confidentiality, integrity, and availability. No patch or official remediation level has been published as of the data provided.

Successful exploitation of this vulnerability allows unauthenticated attackers to inject malicious scripts into web pages generated by the affected plugin. This can lead to partial compromise of user confidentiality, integrity of data, and availability of affected web resources. The vulnerability requires user interaction but no privileges, and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting this plugin. Monitor vendor channels for updates and apply patches promptly once released.