Junglewise Threat Intelligence

CVE-2026-15755: 100plugins Open User Map Stored XSS via Shortcode Attributes

CVE-2026-15755 · Severity: medium · CVSS 6.4 · Published 2026-07-24

Technologies: 100plugins Open User Map. Vendors: 100plugins.

Executive brief

The Open User Map plugin for WordPress, which allows users to add interactive maps to their websites, contains a security flaw that allows certain users to inject malicious scripts. An attacker with contributor-level access can embed these scripts into a post, which then execute when an administrator previews or views the page. This could lead to unauthorized actions being performed on behalf of the administrator or the theft of sensitive session information.

Technical details

The Open User Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via shortcode attributes in versions up to 1.4.45. The root cause is a failure to properly sanitize input and escape output within the plugin's shortcode processing logic. Authenticated attackers with contributor-level permissions or higher can exploit this by injecting arbitrary JavaScript into a post. The payload executes when any user, including an administrator, accesses the affected page or previews a pending post. This vulnerability is tracked as CVE-2026-15755 and has a CVSS score of 6.4.

Affected products

  • 100plugins Open User Map – Interactive Leaflet Maps <= 1.4.45

Timeline

  • 2026-07-24: disclosed: CVE published to the NVD dataset

References

Related threats