100Plugins
Monthly
Unauthenticated Cross-Site Scripting in the Open User Map WordPress plugin (versions <= 1.4.50) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser context of visiting users. The scope-changed CVSS vector (S:C) indicates the injected script executes outside the plugin's own trust boundary, enabling session hijacking, credential theft, or malicious redirects against authenticated site visitors. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated nature and WordPress plugin attack surface make this a realistic target for opportunistic actors.
Stored cross-site scripting (XSS) in Open User Map WordPress plugin versions up to 1.4.46 allows authenticated contributor-level users to inject arbitrary JavaScript into map marker content, which executes when other users view the affected map. No active exploitation has been reported (SSVC: exploitation none), and no public exploit code is identified.
Stored Cross-Site Scripting in the Open User Map - Interactive Leaflet Maps WordPress plugin (all versions through 1.4.45) allows authenticated attackers at contributor level to inject persistent malicious scripts via unsanitized shortcode attributes. Critically, the payload does not require the attacker's post to be published - submitting a draft for pending review is sufficient, because the script executes when an Administrator opens the pending-review preview in normal editorial workflow. No public exploit or CISA KEV listing has been identified at time of analysis, and a source-level patch changeset (3618639) is present in the WordPress plugin repository.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated Cross-Site Scripting in the Open User Map WordPress plugin (versions <= 1.4.50) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser context of visiting users. The scope-changed CVSS vector (S:C) indicates the injected script executes outside the plugin's own trust boundary, enabling session hijacking, credential theft, or malicious redirects against authenticated site visitors. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated nature and WordPress plugin attack surface make this a realistic target for opportunistic actors.
Stored cross-site scripting (XSS) in Open User Map WordPress plugin versions up to 1.4.46 allows authenticated contributor-level users to inject arbitrary JavaScript into map marker content, which executes when other users view the affected map. No active exploitation has been reported (SSVC: exploitation none), and no public exploit code is identified.
Stored Cross-Site Scripting in the Open User Map - Interactive Leaflet Maps WordPress plugin (all versions through 1.4.45) allows authenticated attackers at contributor level to inject persistent malicious scripts via unsanitized shortcode attributes. Critically, the payload does not require the attacker's post to be published - submitting a draft for pending review is sufficient, because the script executes when an Administrator opens the pending-review preview in normal editorial workflow. No public exploit or CISA KEV listing has been identified at time of analysis, and a source-level patch changeset (3618639) is present in the WordPress plugin repository.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.