The Open User Map plugin for WordPress fails to sanitize and escape data supplied in shortcode attributes, enabling authenticated users with contributor-level access or higher to embed malicious scripts that are stored in the database and executed when a page is rendered. The stored payload can run when an administrator previews a pending post, allowing the attacker to inject client‑side code that may steal session cookies, deface content, or redirect users. The vulnerability originates from inadequate input validation and output escaping in the plugin’s handling of shortcode attributes.

All variants of the Open User Map – Interactive Leaflet Maps plugin up to and including version 1.4.45 installed on WordPress sites are affected. Sites that assign contributor or higher capabilities to users can be exploited, because the injection requires an authenticated role to submit the malicious shortcode.

The CVSS score of 6.4 indicates a moderate severity, with the EPSS at less than 1% suggesting a low likelihood of immediate exploitation. Because the vulnerability is not listed in the CISA KEV catalog, there is no current evidence of widespread active exploitation. The attack vector relies on authenticated access; an attacker must first obtain contributor or higher privileges on the target WordPress installation. Once those privileges are achieved, the injection can be performed via the standard post editor interface, and the malicious script will execute whenever an administrator opens the pending‑review preview.