CVE-2023-0094: 
WordPress vulnerability analysis and mitigation

The UpQode Google Maps WordPress plugin through version 1.0.5 contains a stored Cross-Site Scripting (XSS) vulnerability that affects users with contributor roles and above. The vulnerability was publicly disclosed on February 13, 2023 (WPScan).

The vulnerability stems from the plugin's failure to properly validate and escape shortcode attributes before outputting them back in a page or post where the shortcode is embedded. The vulnerability has been assigned a CVSS score of 6.8 (medium) and is classified as CWE-79. The vulnerability specifically affects the upqode-google-maps plugin and requires the WPBakery Page Builder plugin to be installed for exploitation (WPScan).

When exploited, this vulnerability allows users with contributor-level access or higher to perform Stored Cross-Site Scripting attacks. This could potentially lead to the execution of malicious JavaScript code in users' browsers when viewing affected pages (WPScan).

As of the latest reports, there is no known fix available for this vulnerability. Users should consider implementing additional security measures or potentially removing the plugin until a security update is released (WPScan).