EUVD-2026-20837
GHSA-xhg5-7962-f335
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The OSM - OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_name' and 'file_color_list' shortcode attribute of the [osm_map_v3] shortcode in all versions up to and including 6.1.15. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in OSM - OpenStreetMap WordPress plugin versions up to 6.1.15 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript through insufficiently sanitized 'marker_name' and 'file_color_list' shortcode attributes in [osm_map_v3], executing malicious scripts whenever users access affected pages. CVSS 6.4 reflects moderate severity with cross-site impact; exploitation requires valid WordPress user credentials but no user interaction beyond page access.
Technical ContextAI
The OSM - OpenStreetMap plugin (CPE: cpe:2.3:a:photoweblog:osm_-_openstreetmap:*:*:*:*:*:*:*:*) implements WordPress shortcode handlers for map functionality without adequate input validation and output encoding. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the osm_map_v3 shortcode processor where shortcode attributes are processed and rendered to page output without escaping HTML/JavaScript context. Code review locations in osm-sc-osm_map_v3.php (lines 31, 560) and osm-icon-class.php (lines 347, 356) indicate the affected code paths handle user-supplied marker names and color list parameters directly in output generation, bypassing WordPress security functions like esc_attr() or wp_kses_post().
RemediationAI
Update the OSM - OpenStreetMap plugin to a patched version released after 6.1.15; check the WordPress plugin repository and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/65dffde9-2a50-41fe-bc21-3d0915068887?source=cve) for the specific patched version number. In the interim, restrict the [osm_map_v3] shortcode to use only by site administrators via a custom capability filter, or temporarily disable the plugin if not actively in use. Review all published posts and pages containing [osm_map_v3] shortcodes with 'marker_name' or 'file_color_list' attributes for signs of injected scripts, particularly if edited by non-admin users in the past 30 days.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today