WP Maps EUVD-2026-86600

Requires an authenticated WordPress account with at least subscriber-level access on a site running WP Maps (wp-google-map-plugin) <=4.9.8; practically this means the site allows open user registration or the attacker otherwise holds low-privilege credentials. The normal fc-call-nonce barrier is not a meaningful limit because it is exposed to all frontend visitors via window.wpgmp_local.nonce on any map page, and the drawing handler's secondary _wpnonce check can be bypassed by omitting the parameter. Realization of impact requires a victim (e.g., an administrator or site visitor) to subsequently view the page containing the injected shapes_values payload, so payload execution is deferred until page view rather than immediate.

This is a genuine but moderate-severity issue, best characterized as a real-but-low-priority stored XSS. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) is internally consistent with the description: network-reachable, low complexity, requires low privileges (subscriber), scope-changed because injected script executes in other users' browser context, with limited confidentiality/integrity impact and no availability impact. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The notable risk amplifier called out in the description is that the required fc-call-nonce is exposed to ALL frontend visitors via window.wpgmp_local.nonce, and the secondary _wpnonce check in the drawing handler can be bypassed by omitting the parameter entirely - this means the nonce protection provides effectively no barrier, so any subscriber-level account can reliably craft a valid request. That lowers real attack complexity relative to typical nonce-gated WordPress endpoints, though PR:L still correctly gates on having an authenticated subscriber account. Net: prioritize patching on sites that allow open/self-registration (where subscriber accounts are trivially obtained), but this is not a high-CVSS-but-fake issue nor an internet-wide unauthenticated RCE.

On a WordPress site running WP Maps <=4.9.8 that permits user self-registration, an attacker registers a subscriber account, reads the exposed fc-call-nonce from window.wpgmp_local.nonce on any public map page (and/or simply omits _wpnonce to bypass the drawing handler's secondary check), and submits a crafted request injecting a malicious script into the shapes_values parameter. The payload is stored and later executes in the browser of any user (including administrators) who views the affected map page, enabling session/cookie theft or actions in the victim's context. No public exploit code was identified in the provided data.