The affected WordPress OpenStreetMap plug-in, supplied by MiKa, contains an XSS flaw that lets a logged-in editor inject malicious JavaScript into a page via a crafted HTTP request. When an ordinary visitor opens that page the code runs in the visitor’s browser, permitting cookie theft, session hijacking, or other client-side attacks.

This issue impacts sites that use MiKa’s OpenStreetMap plug-in for WordPress. No specific version numbers are listed, so any installation that has not applied recent updates is potentially vulnerable.

The CVSS base score of 5.1 indicates medium severity. Exploit probability data is not provided, and the vulnerability is not in CISA’s KEV list. The likely attack vector is remote via the web interface, but it requires the attacker to first be a legitimate editor or to trick a user into submitting a crafted request. Once the malicious fragment is saved, it is executed automatically for any page viewer.