The CreativeMindsSolutions CM Map Locations plugin is affected by a reflected cross-site scripting vulnerability that could allow an unauthenticated attacker to execute arbitrary scripts in the context of a victim's session.

This is a reflected cross-site scripting (XSS) vulnerability, categorized as CWE-79, caused by improper neutralization of user-supplied input. An unauthenticated attacker can exploit this flaw by tricking a user into interacting with a crafted URL to execute malicious JavaScript within their browser session.

Successful exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of the user, or the theft of sensitive information displayed on the affected web page. Given the CVSS score of 7.1, this is considered a high-severity issue because it facilitates client-side attacks that can compromise user accounts and bypass standard authentication protections.

Immediate Action: Since no specific patch version is currently confirmed, administrators should restrict access to the plugin or disable it until the vendor releases a security update.

Proactive Monitoring: Monitor web application logs for suspicious URL parameters containing script tags or encoded characters that deviate from expected input patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust cross-site scripting filtering rules to block malicious payloads targeting the affected plugin endpoints.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a significant risk to site integrity and user security. Security teams should prioritize the identification of all instances of the CM Map Locations plugin within their environment and prepare to update immediately once the vendor provides a remediation path. In the interim, limiting exposure through WAF rules or disabling the plugin is the most effective way to prevent potential exploitation.