EUVD-2026-16553Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a logged-in user with a page-creating/editing privilege can embed some malicious script with a crafted HTTP request. When a victim user accesses this page, the script may be executed in the user's web browser.
AnalysisAI
Stored cross-site scripting (XSS) in the WordPress OpenStreetMap plugin by MiKa allows authenticated users with page creation or editing privileges to inject malicious scripts that execute in the browsers of other users viewing the affected pages. The vulnerability affects all versions of the plugin via CPE cpe:2.3:a:mika:openstreetmap:*:*:*:*:*:*:*:*. With a CVSS score of 5.4 and moderate attack complexity requiring user interaction, this poses a localized but meaningful risk to WordPress sites where contributors or editors cannot be fully trusted. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), which occurs when user-supplied input is inadequately sanitized or encoded before being reflected in HTML output. The OpenStreetMap WordPress plugin (identified via CPE cpe:2.3:a:mika:openstreetmap:*:*:*:*:*:*:*:*) processes HTTP requests containing crafted shortcode or block parameters without proper input validation or output encoding. When the plugin renders these parameters on the frontend, the malicious script payload executes in the context of the victim user's browser session, potentially allowing session hijacking, credential theft, or malware delivery. The vulnerability is classified as stored XSS because the malicious payload is persisted within the page or post content stored in the WordPress database.
RemediationAI
Update the OpenStreetMap plugin to the latest version available on https://wordpress.org/plugins/osm/ as soon as possible, following the guidance provided in the JVN security notice at https://jvn.jp/en/jp/JVN48058823/. In the interim, restrict page and post editing capabilities to highly trusted users only via WordPress role and capability management, review existing pages for suspicious shortcode parameters or embedded scripts, and consider temporarily disabling the plugin if it is not actively in use. Additionally, implement a Web Application Firewall (WAF) rule to detect and block XSS payloads in POST requests targeting post/page updates, and conduct a security audit of user accounts with contributor or editor roles to identify and revoke unnecessary elevated privileges.
More in Openstreetmap
View allThe OSM - OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'os
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MiKa OSM osm.1.2.
The OSM - OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osm_map' sho
The OSM - OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's osm_map and o
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today