CVE-2026-9594 is a stored cross-site scripting vulnerability in the WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator, Listing, Directory & Filters WordPress plugin. The issue arises from improper neutralization of input during web page generation, specifically via the 'location_messages' parameter. Authenticated attackers with the 'wpgmp_manage_location' capability, typically administrators or roles granted this permission, can inject arbitrary JavaScript that executes in the context of users viewing the injected pages. This vulnerability affects all plugin versions up to and including 4.9.4.

Successful exploitation allows an attacker with high privileges (administrator or equivalent) to inject malicious scripts that execute in the browsers of users who view the affected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed on behalf of users. The CVSS score is 4.4 (medium severity), reflecting the requirement for high privileges and the limited scope of impact.

No official patch or remediation has been confirmed as of the published date. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict the 'wpgmp_manage_location' capability to trusted administrators only and avoid assigning it to lower-privileged roles. Review and sanitize any input passed to the 'location_messages' parameter manually if possible.