The Open User Map PRO plugin for WordPress contains a stored cross‑site scripting flaw that can be exploited by submitting the "oum_location_notification" parameter in an unauthenticated request. The vulnerability allows arbitrary web scripts to be written to the database and executed whenever a user accesses a page that displays that data. Based on the description, it is inferred that these injected scripts could be used to alter content, steal user data, or otherwise compromise the site when visitors load the affected pages.

The impacted product is the Open User Map PRO WordPress plugin from 100plugins, versions 1.4.31 and earlier.

Scored with a CVSS level of 4.7, the vulnerability does not currently appear in the CISA KEV catalog and its EPSS score is unavailable. The likely attack vector is via a public web interface, granting unauthenticated users the ability to inject scripts into stored data with no privilege escalation required. The risk level is moderate, but awareness of the vulnerability remains important as stored XSS can be leveraged for a range of destructive attacks.