Google Maps CP EUVD-2026-41281

Exploitation requires the Google Maps CP plugin (version 1.2.5 or earlier) to be installed and active on a WordPress site, and requires victim user interaction (UI:R) - the target must click a crafted link or load an attacker-controlled page that triggers the vulnerable output path. No authentication is required of the attacker (PR:N), so anyone can craft the payload, but the attack is limited by its dependence on social engineering to get a victim (ideally a privileged/authenticated user) to interact; without that interaction the XSS does not fire. The scope change (S:C) means the executed script can affect the broader WordPress session context rather than only the plugin component.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity, unauthenticated exploitation, but critically requires user interaction (UI:R) - a victim must click a crafted link or visit an attacker-influenced page. The scope-changed (S:C) low-impact triad across confidentiality, integrity, and availability produces the elevated 7.1 score typical of XSS affecting authenticated admin sessions. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the absence of KEV and POC signals suggests this is not yet under active or widespread exploitation. Realistically this is a meaningful but not top-tier priority: it is unauthenticated and easy to trigger, but the UI:R requirement and low individual impacts mean it depends on social engineering rather than automatable mass exploitation.

An attacker crafts a URL or page containing a malicious JavaScript payload targeting the vulnerable Google Maps CP parameter and lures a logged-in WordPress administrator to click it. When the victim's browser renders the unsanitized output, the script executes in the site's origin, allowing the attacker to steal session cookies, perform actions as the admin, or plant a persistent backdoor. No public proof-of-concept was identified in the provided data.