Which versions of WordPress are affected by CVE-2026-33559?

CVE-2026-33559 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 5.1. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2026-33559?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-33559

Q: What is the CVSS score of CVE-2026-33559?

CVE-2026-33559 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16553 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 jpcert

WordPress XSS

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 05:30 euvd

EUVD-2026-16553

Analysis Generated

Mar 27, 2026 - 05:30 vuln.today

CVE Published

Mar 27, 2026 - 04:56 nvd

MEDIUM 5.1

DescriptionCVE.org

WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a logged-in user with a page-creating/editing privilege can embed some malicious script with a crafted HTTP request. When a victim user accesses this page, the script may be executed in the user's web browser.

AnalysisAI

Stored cross-site scripting (XSS) in the WordPress OpenStreetMap plugin by MiKa allows authenticated users with page creation or editing privileges to inject malicious scripts that execute in the browsers of other users viewing the affected pages. The vulnerability affects all versions of the plugin via CPE cpe:2.3:a:mika:openstreetmap:*:*:*:*:*:*:*:*. With a CVSS score of 5.4 and moderate attack complexity requiring user interaction, this poses a localized but meaningful risk to WordPress sites where contributors or editors cannot be fully trusted. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), which occurs when user-supplied input is inadequately sanitized or encoded before being reflected in HTML output. The OpenStreetMap WordPress plugin (identified via CPE cpe:2.3:a:mika:openstreetmap:*:*:*:*:*:*:*:*) processes HTTP requests containing crafted shortcode or block parameters without proper input validation or output encoding. When the plugin renders these parameters on the frontend, the malicious script payload executes in the context of the victim user's browser session, potentially allowing session hijacking, credential theft, or malware delivery. The vulnerability is classified as stored XSS because the malicious payload is persisted within the page or post content stored in the WordPress database.

RemediationAI

Update the OpenStreetMap plugin to the latest version available on https://wordpress.org/plugins/osm/ as soon as possible, following the guidance provided in the JVN security notice at https://jvn.jp/en/jp/JVN48058823/. In the interim, restrict page and post editing capabilities to highly trusted users only via WordPress role and capability management, review existing pages for suspicious shortcode parameters or embedded scripts, and consider temporarily disabling the plugin if it is not actively in use. Additionally, implement a Web Application Firewall (WAF) rule to detect and block XSS payloads in POST requests targeting post/page updates, and conduct a security audit of user accounts with contributor or editor roles to identify and revoke unnecessary elevated privileges.