CVE-2026-15755 Overview
CVE-2026-15755 is a Stored Cross-Site Scripting (XSS) vulnerability in the Open User Map – Interactive Leaflet Maps plugin for WordPress, affecting all versions up to and including 1.4.45. The flaw resides in the plugin's handling of shortcode attributes, where insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or higher to inject arbitrary JavaScript. The injected payload executes when a victim, typically an Administrator previewing a pending post, loads the affected page. This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
A Contributor can weaponize a pending-review post to execute arbitrary scripts in an Administrator's browser session, enabling account takeover and privilege escalation on affected WordPress sites.
Affected Products
- Open User Map – Interactive Leaflet Maps plugin for WordPress
- All versions up to and including 1.4.45
- WordPress sites where Contributor-level or higher accounts exist
Discovery Timeline
- 2026-07-24 - CVE-2026-15755 published to NVD
- 2026-07-24 - Last updated in NVD database
Technical Details for CVE-2026-15755
Vulnerability Analysis
The Open User Map plugin exposes shortcodes that accept user-supplied attributes rendered into the map initialization and rendering templates. The plugin fails to sanitize these attributes on input and does not escape them on output when generating the frontend map markup. As a result, an authenticated Contributor can craft a post containing the vulnerable shortcode with attribute values that break out of the intended HTML context and inject <script> tags or event handlers.
Because exploitation triggers on the pending-review preview flow, the attacker does not need publish rights. When an Administrator opens the pending post to review it, the stored payload executes in the Administrator's browser under the site's origin. This enables session token theft, forced administrative actions via authenticated AJAX requests, or persistent backdoor injection through arbitrary content creation.
Root Cause
The root cause is missing input sanitization and missing output escaping in the shortcode attribute handling. The vulnerable rendering paths are in inc/Pages/Frontend.php (line 120), templates/partial-map-init.php (line 682), and templates/partial-map-render.php (line 450), with related controller logic in inc/Base/BaseController.php (line 1026). Attribute values flow from shortcode parsing directly into HTML and JavaScript contexts without calls to WordPress escaping primitives such as esc_attr(), esc_html(), or esc_js().
Attack Vector
The attack vector is remote and network-based, requiring only Contributor privileges. The attacker inserts the Open User Map shortcode into a post body with a malicious attribute payload, then submits the post for pending review. When any user with edit access, typically an Administrator, views the preview or renders the shortcode, the injected script executes in that user's session context. See the WordPress Plugin Frontend Code and Wordfence Vulnerability Intelligence for technical references.
Detection Methods for CVE-2026-15755
Indicators of Compromise
- Presence of the Open User Map plugin at version 1.4.45 or earlier in wp-content/plugins/open-user-map/
- Post or page content containing Open User Map shortcodes with suspicious attribute values including <script>, onerror=, onload=, or javascript: strings
- Unexpected outbound requests from Administrator browsers to unfamiliar domains shortly after previewing pending posts
- Creation of new administrative WordPress accounts or unauthorized plugin installations following a Contributor post submission
Detection Strategies
- Audit the WordPress wp_posts table for shortcode invocations belonging to Open User Map and inspect their attribute contents for HTML or JavaScript payloads
- Deploy web application firewall rules that inspect shortcode attribute values submitted through post.php and admin-ajax.php for XSS signatures
- Correlate Contributor account submissions with subsequent Administrator preview actions in access logs to identify potential exploitation chains
Monitoring Recommendations
- Monitor WordPress user role changes and plugin file modifications for anomalous activity following pending-review previews
- Log and review all shortcode content submitted by non-Editor accounts on a recurring cadence
- Alert on browser-side security events such as Content Security Policy violations originating from WordPress admin pages
How to Mitigate CVE-2026-15755
Immediate Actions Required
- Update the Open User Map – Interactive Leaflet Maps plugin to a version newer than 1.4.45 as soon as the vendor publishes a patched release
- Audit existing Contributor and Author accounts and remove any that are unnecessary or inactive
- Review all pending and published posts containing Open User Map shortcodes for malicious attribute payloads and purge affected content
- Rotate WordPress Administrator passwords and invalidate active sessions if suspicious preview activity is identified
Patch Information
At the time of publication, the vulnerability affects all versions up to and including 1.4.45. Site operators should monitor the WordPress Plugin Changeset and the Wordfence Vulnerability Intelligence advisory for the fixed release and apply it through the WordPress plugin update mechanism.
Workarounds
- Temporarily deactivate the Open User Map plugin until a patched version is available
- Restrict Contributor-level access using a role management plugin to prevent shortcode usage in post content
- Enforce a strict Content Security Policy on the WordPress admin domain to limit inline script execution during post preview
- Require Editor or higher review workflows that inspect shortcode attributes before any preview action is taken
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
