The OSM – OpenStreetMap plugin for WordPress contains a stored Cross‑Site Scripting flaw in the marker_name and file_color_list attributes of the [osm_map_v3] shortcode. Because the plugin fails to sanitize or escape these inputs, an authenticated user with Contributor level access or higher can insert arbitrary JavaScript that will run in the browsers of anyone who views a page containing the injected shortcode. This vulnerability permits attackers to execute client‑side code in the context of the site, enabling session hijacking, defacement, or the delivery of additional malicious payloads.

WordPress installations that use the OSM – OpenStreetMap plugin, versions up to and including 6.1.15. Sites that have installed this plugin and grant Contributor or higher privileges to users are vulnerable. The vulnerability is specific to the plugin's handling of the [osm_map_v3] shortcode.

The CVSS score of 6.4 indicates a medium severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated Contributor or better, making the attack vector internal. Once a shortcode is injected, the stored payload remains until the content is edited or the plugin is updated. Because the threat relies on user privileges, sites that limit Contributor access or use the latest version are less exposed. Nonetheless, if an attacker compromises a contributor account, the risk is significant for the affected website.