Stored Cross-Site Scripting Vulnerability Affects OpenStreetMap Plugin for WordPress

CVE-2024-11827

What is CVE-2024-11827?

The OpenStreetMap plugin for WordPress is exposed to a stored cross-site scripting vulnerability, allowing authenticated users with contributor-level access or higher to inject malicious scripts. This issue arises from the plugin's insufficient input sanitization and output escaping processes, particularly concerning the ootb_query shortcode. Attackers can craft payloads that execute arbitrary web scripts on pages accessed by users, potentially leading to severe security breaches. Administrators of sites utilizing this plugin should prioritize updating to a secure version and implementing additional input validation measures.

References