Is CVE-2026-15755 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15755 being exploited in the wild.

How severe is CVE-2026-15755?

Medium severity, with a CVSS score of 6.4, published 24 July 2026.

Which products and versions are affected?

100plugins Open User Map <= 1.4.45.

Is there a fix for CVE-2026-15755?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15755 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-15755?

Check whether you run 100plugins Open User Map at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15755: 100plugins Open User Map Stored XSS via Shortcode Attributes

Q: Is there a fix for CVE-2026-15755?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-15755 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-15755?

Check whether you run 100plugins Open User Map at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15755 · Severity: medium · CVSS 6.4 · Published 2026-07-24

The Open User Map plugin for WordPress, which allows users to add interactive maps to their websites, contains a security flaw that allows certain users to inject malicious scripts. An attacker with contributor-level access can embed these scripts into a post, which then execute when an administrator previews or views the page. This could lead to unauthorized actions being performed on behalf of the administrator or the theft of sensitive session information.

Technologies: 100plugins Open User Map. Vendors: 100plugins.

Quick answers

Is CVE-2026-15755 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15755 being exploited in the wild.
How severe is CVE-2026-15755?: Medium severity, with a CVSS score of 6.4, published 24 July 2026.
Which products and versions are affected?: 100plugins Open User Map <= 1.4.45.
Is there a fix for CVE-2026-15755?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15755 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-15755?: Check whether you run 100plugins Open User Map at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Open User Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via shortcode attributes in versions up to 1.4.45. The root cause is a failure to properly sanitize input and escape output within the plugin's shortcode processing logic. Authenticated attackers with contributor-level permissions or higher can exploit this by injecting arbitrary JavaScript into a post. The payload executes when any user, including an administrator, accesses the affected page or previews a pending post. This vulnerability is tracked as CVE-2026-15755 and has a CVSS score of 6.4.

Affected products

100plugins Open User Map – Interactive Leaflet Maps <= 1.4.45

Timeline

2026-07-24: disclosed: CVE published to the NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.