Stored Cross-Site Scripting in Open User Map PRO Plugin for WordPress
CVE-2026-2827

4.7MEDIUM

Key Information:

Vendor

WordPress
Status
Open User Map Pro
Vendor
CVE Published:
11 June 2026

What is CVE-2026-2827?

The Open User Map PRO plugin for WordPress has a vulnerability that allows stored cross-site scripting due to inadequate input sanitization and output escaping in the 'oum_location_notification' parameter. This flaw enables unauthenticated attackers to inject malicious scripts that can execute in the browsers of users visiting affected pages, posing a significant security risk to WordPress sites utilizing this plugin.

Affected Version(s)

Open User Map PRO 0 <= 1.4.31

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.open-user-map.com/

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hunter Jensen
.