CVE-2026-84818: WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Open User Map pluginto a version that resolves this vulnerability.Fixed in 1.4.51
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or plugin-specific privileges. Exploitation still requires user interaction, as indicated by the UI:R vector.
Which installations are affected?
WordPress sites using Open User Map version 1.4.50 or earlier are affected according to the available information. The data does not identify a fixed version or any configuration conditions that would limit exposure.
What impact can successful exploitation have?
Successful XSS can affect confidentiality, integrity, and availability, each with low impact in the supplied CVSS vector. The scope is changed, meaning the impact can extend beyond the vulnerable plugin's security authority.