Easy Google Maps EUVD-2026-89943

Exploitation requires an unauthenticated attacker to deliver crafted input to a site running Easy Google Maps <= 1.14.6 AND to induce a victim to interact (UI:R) - typically clicking a malicious link or visiting an attacker-influenced page - for the injected script to execute. The exact vulnerable parameter and sink are not specified in the advisory. The limiting factors are the mandatory user interaction (reducing viability of unattended/automated attacks) and the Low individual C/I/A impacts; impact escalates materially only if the victim is a privileged user such as an administrator. No non-default configuration is stated as required beyond having the plugin installed and active.

This is a genuine but moderate-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) describes a network-reachable, low-complexity, unauthenticated XSS whose severity is elevated to 'High' primarily by the scope change (S:C) inherent to cross-context script execution, offset by required user interaction (UI:R) and only Low impacts across C/I/A. No EPSS score, no CISA KEV listing, and no public exploit code (POC) were provided, so all exploitation signals point to no active or automated exploitation at this time - the score is driven by the vector, not by observed attacker behavior. There is no SSVC decision data in the input. The signals are internally consistent (Patchstack-reported reflected/stored XSS with UI:R aligns with a 7.1). The main uncertainty is that the description is sparse: it does not name the injected parameter, the sink, or whether the XSS is reflected or stored. UI:R combined with unauthenticated (PR:N) most commonly indicates reflected XSS requiring a victim to click a crafted link, which limits mass exploitation.

An unauthenticated attacker crafts a URL or request against a WordPress site running Easy Google Maps <= 1.14.6 that injects JavaScript into a page rendered by the plugin, then lures a victim (potentially a logged-in administrator) into loading it. When the victim's browser renders the page, the script executes in the site's origin, enabling session/cookie theft, admin-action forgery, or redirection. No public exploit code was identified at time of analysis.