CVE-2026-15755

Name of the Vulnerable Software and Affected Versions Open User Map – Interactive Leaflet Maps plugin for WordPress versions prior to 1.4.46

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via shortcode attributes, enabling the injection of arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. The issue can be triggered even before a post is published, as the payload executes when an administrator views a post submitted for pending review.

Recommendations Update the plugin to version 1.4.46 or later.