Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack does not require post publication; a Contributor submitting a post for pending review is sufficient, as the payload executes when an Administrator opens the pending-review preview.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-15755 Stored Cross-Site Scripting in Open User Map Plugin for WordPress 1.4.45 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15755
Post summary
The post announces a stored XSS vulnerability (CVE‑2026‑15755) in the Open User Map WordPress plugin version 1.4.45, providing no evidence of active exploitation, PoC, or mitigation.