What is the CVSS score of CVE-2026-4429?

CVE-2026-4429 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2026-4429

EUVD-2026-20837 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-09 Wordfence

GHSA-xhg5-7962-f335

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 03:30 euvd

EUVD-2026-20837

Analysis Generated

Apr 09, 2026 - 03:30 vuln.today

CVE Published

Apr 09, 2026 - 02:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The OSM - OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_name' and 'file_color_list' shortcode attribute of the [osm_map_v3] shortcode in all versions up to and including 6.1.15. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in OSM - OpenStreetMap WordPress plugin versions up to 6.1.15 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript through insufficiently sanitized 'marker_name' and 'file_color_list' shortcode attributes in [osm_map_v3], executing malicious scripts whenever users access affected pages. CVSS 6.4 reflects moderate severity with cross-site impact; exploitation requires valid WordPress user credentials but no user interaction beyond page access.

Technical ContextAI

The OSM - OpenStreetMap plugin (CPE: cpe:2.3:a:photoweblog:osm_-_openstreetmap:*:*:*:*:*:*:*:*) implements WordPress shortcode handlers for map functionality without adequate input validation and output encoding. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the osm_map_v3 shortcode processor where shortcode attributes are processed and rendered to page output without escaping HTML/JavaScript context. Code review locations in osm-sc-osm_map_v3.php (lines 31, 560) and osm-icon-class.php (lines 347, 356) indicate the affected code paths handle user-supplied marker names and color list parameters directly in output generation, bypassing WordPress security functions like esc_attr() or wp_kses_post().

RemediationAI

Update the OSM - OpenStreetMap plugin to a patched version released after 6.1.15; check the WordPress plugin repository and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/65dffde9-2a50-41fe-bc21-3d0915068887?source=cve) for the specific patched version number. In the interim, restrict the [osm_map_v3] shortcode to use only by site administrators via a custom capability filter, or temporarily disable the plugin if not actively in use. Review all published posts and pages containing [osm_map_v3] shortcodes with 'marker_name' or 'file_color_list' attributes for signs of injected scripts, particularly if edited by non-admin users in the past 30 days.