CVE-2026-7464 is a reflected cross-site scripting vulnerability in the WP Google Maps Integration WordPress plugin affecting all versions up to 1.2. The issue stems from improper neutralization of input in the 'page' parameter, allowing injection of malicious scripts that execute when an administrator interacts with a crafted link. The vulnerability requires user interaction and does not require privileges to exploit, but it can lead to partial confidentiality and integrity impact. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, scoring 6.1 (medium severity). No patch or official fix is currently documented.

An attacker can inject and execute arbitrary scripts in the context of an administrator's browser session by exploiting the reflected XSS vulnerability. This can lead to partial disclosure of sensitive information and modification of data accessible to the administrator. There is no impact on availability. Exploitation requires tricking an administrator into clicking a malicious link. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when clicking on untrusted links related to the WP Google Maps Integration plugin. Monitoring for updates from the vendor or plugin maintainers is recommended to apply any forthcoming patches promptly.