What is the CVSS score of CVE-2026-2827?

CVE-2026-2827 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Open User Map PRO CVE-2026-2827

EUVD-2026-36198 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-11 security@wordfence.com

GHSA-x7wp-5p27-3p93

WordPress XSS

4.7

CVSS 3.1 · NVD

Severity by source

Vendor (wordfence) PRIMARY

MEDIUM

qualitative

NVD

4.7 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

4.7 MEDIUM

Unauthenticated network injection (AV:N, PR:N) but requires victim page visit (UI:R) and specific display conditions (AC:H); scope changes to browser context (S:C) with limited confidentiality and integrity impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 11, 2026 - 02:26 vuln.today

CVE Published

Jun 11, 2026 - 02:16 nvd

MEDIUM 4.7

DescriptionNVD

The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notification' parameter in versions up to, and including, 1.4.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Open User Map PRO WordPress plugin (versions ≤ 1.4.31) via the 'oum_location_notification' parameter enables unauthenticated attackers to persistently inject arbitrary JavaScript into WordPress pages. The injected payload executes in any visitor's browser upon accessing the affected page, with scope extending beyond the originating application context (S:C). No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection surface lowers the barrier for mass exploitation against unpatched sites.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-controlled input submitted via the 'oum_location_notification' parameter is stored without adequate sanitization and later rendered without output escaping, allowing script tags or event-handler payloads to survive into the HTML response. The affected product is the commercial 'Open User Map PRO' plugin for WordPress, a mapping/location-management plugin that collects user-submitted location data including notification fields. The plugin likely exposes this parameter through a front-end form accessible to unauthenticated site visitors, consistent with PR:N in the CVSS vector. The changed scope (S:C) reflects that while the vulnerability resides in the WordPress application, the ultimate impact occurs in the victim's browser - a distinct security context governed by the Same-Origin Policy.

RemediationAI

The primary remediation is to update the Open User Map PRO plugin to a version beyond 1.4.31. No exact patched release version was confirmed in the available data - administrators should check the plugin's official changelog at https://www.open-user-map.com/ or the WordPress plugin repository for a release that addresses CVE-2026-2827. If an immediate update is not possible, compensating controls include: disabling or restricting the location-submission feature that exposes the 'oum_location_notification' parameter to unauthenticated users (reduces the injection surface but may break plugin functionality); deploying a Web Application Firewall rule (e.g., Wordfence firewall) to block script-containing payloads in that parameter (may produce false positives on legitimate angle-bracket content); and restricting access to pages that render location notification content to authenticated users only via WordPress capability checks. Site administrators should also audit existing stored location notification entries for injected payloads and remove any suspicious content.