Open User Map Interactive Leaflet Maps
Monthly
Stored Cross-Site Scripting in the Open User Map - Interactive Leaflet Maps WordPress plugin (all versions through 1.4.45) allows authenticated attackers at contributor level to inject persistent malicious scripts via unsanitized shortcode attributes. Critically, the payload does not require the attacker's post to be published - submitting a draft for pending review is sufficient, because the script executes when an Administrator opens the pending-review preview in normal editorial workflow. No public exploit or CISA KEV listing has been identified at time of analysis, and a source-level patch changeset (3618639) is present in the WordPress plugin repository.
Stored Cross-Site Scripting in the Open User Map - Interactive Leaflet Maps WordPress plugin (all versions through 1.4.45) allows authenticated attackers at contributor level to inject persistent malicious scripts via unsanitized shortcode attributes. Critically, the payload does not require the attacker's post to be published - submitting a draft for pending review is sufficient, because the script executes when an Administrator opens the pending-review preview in normal editorial workflow. No public exploit or CISA KEV listing has been identified at time of analysis, and a source-level patch changeset (3618639) is present in the WordPress plugin repository.