EUVD-2026-36198
GHSA-x7wp-5p27-3p93
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated network injection (AV:N, PR:N) but requires victim page visit (UI:R) and specific display conditions (AC:H); scope changes to browser context (S:C) with limited confidentiality and integrity impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notification' parameter in versions up to, and including, 1.4.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Open User Map PRO WordPress plugin (versions ≤ 1.4.31) via the 'oum_location_notification' parameter enables unauthenticated attackers to persistently inject arbitrary JavaScript into WordPress pages. The injected payload executes in any visitor's browser upon accessing the affected page, with scope extending beyond the originating application context (S:C). No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection surface lowers the barrier for mass exploitation against unpatched sites.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-controlled input submitted via the 'oum_location_notification' parameter is stored without adequate sanitization and later rendered without output escaping, allowing script tags or event-handler payloads to survive into the HTML response. The affected product is the commercial 'Open User Map PRO' plugin for WordPress, a mapping/location-management plugin that collects user-submitted location data including notification fields. The plugin likely exposes this parameter through a front-end form accessible to unauthenticated site visitors, consistent with PR:N in the CVSS vector. The changed scope (S:C) reflects that while the vulnerability resides in the WordPress application, the ultimate impact occurs in the victim's browser - a distinct security context governed by the Same-Origin Policy.
RemediationAI
The primary remediation is to update the Open User Map PRO plugin to a version beyond 1.4.31. No exact patched release version was confirmed in the available data - administrators should check the plugin's official changelog at https://www.open-user-map.com/ or the WordPress plugin repository for a release that addresses CVE-2026-2827. If an immediate update is not possible, compensating controls include: disabling or restricting the location-submission feature that exposes the 'oum_location_notification' parameter to unauthenticated users (reduces the injection surface but may break plugin functionality); deploying a Web Application Firewall rule (e.g., Wordfence firewall) to block script-containing payloads in that parameter (may produce false positives on legitimate angle-bracket content); and restricting access to pages that render location notification content to authenticated users only via WordPress capability checks. Site administrators should also audit existing stored location notification entries for injected payloads and remove any suspicious content.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today