The Mapster WP Maps plugin for WordPress versions up to and including 2.0.5 is vulnerable to stored cross-site scripting (XSS). The vulnerability arises because the REST route /wp-json/mapster-wp-maps/save-mapmaker lacks proper permission checks, allowing unauthenticated attackers to inject scripts. The plugin's sanitization only removes HTML tags but leaves quote characters intact, and the injected value is concatenated into an inline style attribute without proper escaping. This enables execution of arbitrary scripts when a user views an affected page.