Stored Cross-Site Scripting in Open User Map Plugin for WordPress

CVE-2026-15755

What is CVE-2026-15755?

The Open User Map – Interactive Leaflet Maps plugin for WordPress has a vulnerability that allows attackers with contributor-level access and above to inject arbitrary web scripts into pages via Shortcode Attributes. This issue stems from inadequate input sanitization and output escaping, enabling malicious scripts to execute in the context of users who access affected pages. Notably, the execution occurs without needing post publication; even a pending review post submitted by a Contributor can pose a risk as scripts run when an Administrator previews the post.

References