CVE-2026-15755 in Open User Map Plugin
Summary
by MITRE • 07/24/2026
The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack does not require post publication; a Contributor submitting a post for pending review is sufficient, as the payload executes when an Administrator opens the pending-review preview.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/24/2026
The Open User Map plugin for WordPress represents a critical security vulnerability through its susceptibility to stored cross-site scripting attacks that can be exploited by users with contributor-level privileges or higher. This vulnerability affects all versions up to and including 1.4.45, creating a significant risk for WordPress installations that utilize this mapping plugin. The flaw exists within the plugin's handling of shortcode attributes where insufficient input sanitization and output escaping mechanisms fail to properly validate or encode user-supplied data before it is processed and rendered in web pages.
The technical implementation of this vulnerability stems from the plugin's failure to adequately sanitize shortcode parameters that are passed through WordPress posts and pages. When authenticated users with contributor-level access create or edit posts containing malicious shortcode attributes, these inputs are stored within the WordPress database without proper validation. The vulnerability specifically manifests when administrators or other privileged users view pending review posts, as the preview functionality executes the stored malicious code within the context of the administrator's browser session. This execution occurs through the plugin's shortcode processing mechanism which fails to escape output before rendering HTML content, allowing attackers to inject arbitrary JavaScript payloads that persist across multiple page views.
The operational impact of this vulnerability extends beyond simple script execution as it enables attackers to perform a wide range of malicious activities including but not limited to credential theft, session hijacking, and data exfiltration. The attack vector does not require post publication, making it particularly dangerous because contributors can submit malicious content that remains dormant until an administrator reviews the pending post. This timing aspect creates an ideal environment for social engineering attacks where attackers can craft payloads designed to exploit administrator privileges during routine review processes. The vulnerability demonstrates a clear failure in the principle of least privilege and input validation, as it allows users with relatively low permissions to compromise higher-privilege accounts through the execution of stored scripts.
Security professionals should note that this vulnerability aligns with common weakness enumerations such as CWE-79 which describes cross-site scripting flaws, and follows attack patterns documented in the ATT&CK framework under technique T1566 for credential access through social engineering. The vulnerability also reflects poor input validation practices typical of software development security issues where sanitization occurs too late in the processing pipeline or not at all. Organizations should immediately implement mitigation strategies including plugin updates to versions that address this vulnerability, implementation of role-based access controls that limit contributor capabilities, and regular monitoring of pending posts for suspicious activity. Additionally, administrators should consider implementing web application firewalls to detect and block malicious script payloads before they can be executed, while maintaining comprehensive logging of all shortcode usage within WordPress installations.
The remediation process requires immediate attention from system administrators who must update the Open User Map plugin to a version that implements proper input sanitization and output escaping mechanisms. This includes ensuring that all user-provided shortcode attributes undergo rigorous validation before being stored in the database and that any output generated by the plugin properly escapes HTML entities to prevent script execution. Organizations should also consider implementing additional security measures such as content security policies that restrict script execution within WordPress admin interfaces, regular security audits of installed plugins for similar vulnerabilities, and employee training on recognizing potential social engineering attacks that exploit these privilege escalation vectors. The vulnerability serves as a reminder of the critical importance of input validation in web applications and demonstrates how seemingly minor security flaws can create significant risks when combined with user privilege escalation opportunities within content management systems.