The WP Maps plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input in the 'location_messages' parameter. Authenticated users with the wpgmp_manage_location capability, typically administrators, can inject arbitrary JavaScript into pages. This vulnerability affects all versions up to 4.9.4. The CVSS 3.1 base score is 4.4, reflecting medium severity with network attack vector, high attack complexity, high privileges required, no user interaction, and impact limited to low confidentiality and integrity impact without availability impact. No official patch or remediation level has been published as of the data provided.

Successful exploitation allows an attacker with administrator-level privileges to inject and execute arbitrary scripts in the context of the affected site, potentially leading to session hijacking, defacement, or other client-side attacks against users viewing the injected content. The impact is limited to confidentiality and integrity with no direct availability impact. Since exploitation requires high privileges, the risk is mitigated somewhat by the need for administrative access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict the assignment of the wpgmp_manage_location capability to trusted administrators only. Review and limit plugin permissions to minimize exposure. Monitor for plugin updates from flippercode and apply official patches promptly once available.