CVE-2026-7464 is a reflected cross-site scripting vulnerability in the WP Google Maps Integration WordPress plugin affecting all versions up to 1.2. The issue is caused by improper neutralization of input in the 'page' parameter, allowing injection of arbitrary web scripts. This vulnerability can be exploited by unauthenticated attackers who can trick an administrator into clicking a crafted link, resulting in script execution within the admin context. The CVSS 3.1 base score is 6.1 (medium severity), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No official fix or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of an administrator's browser session, potentially leading to unauthorized actions or data disclosure limited to the confidentiality and integrity impacts described by the CVSS score. There is no impact on system availability. The vulnerability requires user interaction (administrator clicking a malicious link) and does not require prior authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links that could exploit the 'page' parameter in the WP Google Maps Integration plugin. Monitoring for updates from the vendor or plugin maintainers is recommended to apply any future patches promptly.