Executive brief
The OpenStreetMap plugin for WordPress, which allows users to embed interactive maps into their websites, contains a security flaw. An attacker with basic contributor-level access can inject malicious scripts into pages. These scripts will automatically run in the browser of any visitor who views the affected page, potentially leading to unauthorized actions or data theft.
Technical details
The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'marker_name' and 'file_color_list' attributes of the [osm_map_v3] shortcode. This vulnerability exists in all versions up to and including 6.1.15. An authenticated attacker with Contributor-level permissions or higher can exploit this by embedding malicious JavaScript within a shortcode on a post or page. When other users, including administrators, view the affected content, the script executes within their browser session. The vulnerability is tracked as CWE-79 and has been addressed in subsequent updates.
Affected products
- photoweblog OSM – OpenStreetMap up to and including 6.1.15
Timeline
- 2026-04-09: disclosed
- 2026-04-09: advisory
References
- https://plugins.trac.wordpress.org/browser/osm/tags/6.1.15/osm-icon-class.php
- https://plugins.trac.wordpress.org/browser/osm/tags/6.1.15/osm-icon-class.php
- https://plugins.trac.wordpress.org/browser/osm/tags/6.1.15/osm_map_v3/osm-sc-osm_map_v3.php
- https://plugins.trac.wordpress.org/browser/osm/tags/6.1.15/osm_map_v3/osm-sc-osm_map_v3.php
- https://plugins.trac.wordpress.org/browser/osm/trunk/osm-icon-class.php
- https://plugins.trac.wordpress.org/browser/osm/trunk/osm-icon-class.php
- https://plugins.trac.wordpress.org/browser/osm/trunk/osm_map_v3/osm-sc-osm_map_v3.php