Join the Cyber Forum: Threat Intel on May 12, 2026 to learn how AI is reshaping threat defense.Join the Virtual Cyber Forum: Threat IntelRegister Now
Experiencing a Breach?Blog
Get StartedContact Us
SentinelOne
  • Platform
    Platform Overview
    • Singularity Platform
      Welcome to Integrated Enterprise Security
    • AI for Security
      Leading the Way in AI-Powered Security Solutions
    • Securing AI
      Accelerate AI Adoption with Secure AI Tools, Apps, and Agents.
    • How It Works
      The Singularity XDR Difference
    • Singularity Marketplace
      One-Click Integrations to Unlock the Power of XDR
    • Pricing & Packaging
      Comparisons and Guidance at a Glance
    Data & AI
    • Purple AI
      Accelerate SecOps with Generative AI
    • Singularity Hyperautomation
      Easily Automate Security Processes
    • AI-SIEM
      The AI SIEM for the Autonomous SOC
    • AI Data Pipelines
      Security Data Pipeline for AI SIEM and Data Optimization
    • Singularity Data Lake
      AI-Powered, Unified Data Lake
    • Singularity Data Lake for Log Analytics
      Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
    Endpoint Security
    • Singularity Endpoint
      Autonomous Prevention, Detection, and Response
    • Singularity XDR
      Native & Open Protection, Detection, and Response
    • Singularity RemoteOps Forensics
      Orchestrate Forensics at Scale
    • Singularity Threat Intelligence
      Comprehensive Adversary Intelligence
    • Singularity Vulnerability Management
      Application & OS Vulnerability Management
    • Singularity Identity
      Identity Threat Detection and Response
    Cloud Security
    • Singularity Cloud Security
      Block Attacks with an AI-Powered CNAPP
    • Singularity Cloud Native Security
      Secure Cloud and Development Resources
    • Singularity Cloud Workload Security
      Real-Time Cloud Workload Protection Platform
    • Singularity Cloud Data Security
      AI-Powered Threat Detection for Cloud Storage
    • Singularity Cloud Security Posture Management
      Detect and Remediate Cloud Misconfigurations
    Securing AI
    • Prompt Security
      Secure AI Tools Across Your Enterprise
  • Why SentinelOne?
    Why SentinelOne?
    • Why SentinelOne?
      Cybersecurity Built for What’s Next
    • Our Customers
      Trusted by the World’s Leading Enterprises
    • Industry Recognition
      Tested and Proven by the Experts
    • About Us
      The Industry Leader in Autonomous Cybersecurity
    Compare SentinelOne
    • Arctic Wolf
    • Broadcom
    • CrowdStrike
    • Cybereason
    • Microsoft
    • Palo Alto Networks
    • Sophos
    • Splunk
    • Trellix
    • Trend Micro
    • Wiz
    Verticals
    • Energy
    • Federal Government
    • Finance
    • Healthcare
    • Higher Education
    • K-12 Education
    • Manufacturing
    • Retail
    • State and Local Government
  • Services
    Managed Services
    • Managed Services Overview
      Wayfinder Threat Detection & Response
    • Threat Hunting
      World-Class Expertise and Threat Intelligence
    • Managed Detection & Response
      24/7/365 Expert MDR Across Your Entire Environment
    • Incident Readiness & Response
      DFIR, Breach Readiness, & Compromise Assessments
    Support, Deployment, & Health
    • Technical Account Management
      Customer Success with Personalized Service
    • SentinelOne GO
      Guided Onboarding & Deployment Advisory
    • SentinelOne University
      Live and On-Demand Training
    • Services Overview
      Comprehensive Solutions for Seamless Security Operations
    • SentinelOne Community
      Community Login
  • Partners
    Our Network
    • MSSP Partners
      Succeed Faster with SentinelOne
    • Singularity Marketplace
      Extend the Power of S1 Technology
    • Cyber Risk Partners
      Enlist Pro Response and Advisory Teams
    • Technology Alliances
      Integrated, Enterprise-Scale Solutions
    • SentinelOne for AWS
      Hosted in AWS Regions Around the World
    • Channel Partners
      Deliver the Right Solutions, Together
    • SentinelOne for Google Cloud
      Unified, Autonomous Security Giving Defenders the Advantage at Global Scale
    • Partner Locator
      Your Go-to Source for Our Top Partners in Your Region
    Partner Portal→
  • Resources
    Resource Center
    • Case Studies
    • Data Sheets
    • eBooks
    • Reports
    • Videos
    • Webinars
    • Whitepapers
    • Events
    View All Resources→
    Blog
    • Feature Spotlight
    • For CISO/CIO
    • From the Front Lines
    • Identity
    • Cloud
    • macOS
    • SentinelOne Blog
    Blog→
    Tech Resources
    • SentinelLABS
    • Ransomware Anthology
    • Cybersecurity 101
  • About
    About SentinelOne
    • About SentinelOne
      The Industry Leader in Cybersecurity
    • Investor Relations
      Financial Information & Events
    • SentinelLABS
      Threat Research for the Modern Threat Hunter
    • Careers
      The Latest Job Opportunities
    • Press & News
      Company Announcements
    • Cybersecurity Blog
      The Latest Cybersecurity Threats, News, & More
    • FAQ
      Get Answers to Our Most Frequently Asked Questions
    • DataSet
      The Live Data Platform
    • S Foundation
      Securing a Safer Future for All
    • S Ventures
      Investing in the Next Generation of Security, Data and AI
  • Pricing
Get StartedContact Us
CVE Vulnerability Database
Vulnerability Database/CVE-2026-4429

CVE-2026-4429: OSM OpenStreetMap WordPress XSS Flaw

CVE-2026-4429 is a stored cross-site scripting vulnerability in the OSM OpenStreetMap WordPress plugin affecting versions up to 6.1.15. Attackers with Contributor access can inject malicious scripts via shortcode attributes.

Published: April 9, 2026

CVE-2026-4429 Overview

The OSM – OpenStreetMap plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the [osm_map_v3] shortcode. Specifically, the marker_name and file_color_list shortcode attributes fail to properly sanitize user input and escape output, allowing authenticated attackers with Contributor-level access or above to inject malicious JavaScript code. When an unsuspecting user visits a page containing the injected payload, the malicious scripts execute in their browser context.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in visitors' browsers, potentially leading to session hijacking, credential theft, or malware distribution across WordPress sites using this plugin.

Affected Products

  • OSM – OpenStreetMap plugin for WordPress versions up to and including 6.1.15
  • WordPress sites with Contributor-level or higher user access enabled
  • Any WordPress installation utilizing the [osm_map_v3] shortcode functionality

Discovery Timeline

  • April 9, 2026 - CVE-2026-4429 published to NVD
  • April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4429

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The issue arises because the OSM plugin fails to implement proper input validation and output encoding for shortcode attributes processed within the [osm_map_v3] shortcode handler.

The vulnerable code paths can be traced to multiple locations in the plugin codebase, including osm-icon-class.php at lines 347 and 356, as well as osm-sc-osm_map_v3.php at lines 31 and 560. The attack vector is network-based and requires authentication at a low privilege level (Contributor), but once the malicious content is stored, no further user interaction is required for the script to execute.

Root Cause

The root cause of this vulnerability is insufficient input sanitization and output escaping in the shortcode processing logic. When the marker_name and file_color_list attributes are processed by the plugin, user-supplied values are rendered directly into the page HTML without proper encoding. WordPress provides functions such as esc_attr(), esc_html(), and wp_kses() specifically to prevent XSS attacks, but these safeguards were not implemented for the affected shortcode attributes.

Attack Vector

An attacker with Contributor-level access or higher can craft a malicious shortcode containing JavaScript payloads within the marker_name or file_color_list attributes. When this shortcode is embedded in a post or page and published (or submitted for review), the malicious script becomes persistently stored in the WordPress database. Subsequently, any user who views the page—including administrators—will have the malicious JavaScript execute in their browser context.

The attack enables various malicious activities including session cookie theft, keylogging, phishing overlay injection, drive-by download initiation, and administrative action execution on behalf of privileged users. For detailed technical analysis, refer to the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-4429

Indicators of Compromise

  • Unexpected JavaScript code or <script> tags appearing within [osm_map_v3] shortcode attributes in posts, pages, or custom post types
  • Browser developer console errors or suspicious network requests originating from map-embedded pages
  • Anomalous outbound connections to unknown domains when users view pages containing OpenStreetMap embeds
  • Reports of unexpected browser behavior or pop-ups from users viewing WordPress content with OSM maps

Detection Strategies

  • Implement Web Application Firewall (WAF) rules to detect and block XSS patterns in shortcode parameters
  • Conduct regular database audits scanning the wp_posts table for suspicious patterns within [osm_map_v3] shortcode content
  • Enable Content Security Policy (CSP) headers to restrict script execution sources and receive violation reports
  • Deploy SentinelOne Singularity XDR to monitor for behavioral anomalies associated with XSS exploitation

Monitoring Recommendations

  • Configure WordPress audit logging to track all shortcode usage and post modifications by Contributor-level users
  • Monitor server access logs for unusual patterns in requests to pages containing OSM map embeds
  • Implement real-time alerting for CSP violation reports indicating inline script execution attempts
  • Review user activity logs for bulk content creation or modification patterns that may indicate exploitation attempts

How to Mitigate CVE-2026-4429

Immediate Actions Required

  • Update the OSM – OpenStreetMap plugin to the latest patched version immediately
  • Audit all existing posts and pages for potentially malicious content in [osm_map_v3] shortcode attributes
  • Review user accounts with Contributor-level access and above for any unauthorized or suspicious activity
  • Consider temporarily disabling the OSM plugin until the update can be applied if immediate patching is not possible

Patch Information

A security patch addressing this vulnerability has been released. The fix implements proper input sanitization and output escaping for the marker_name and file_color_list shortcode attributes. The changeset details are available in the WordPress plugin repository. Site administrators should update to the latest version through the WordPress admin dashboard or via WP-CLI.

Workarounds

  • Restrict Contributor-level access to trusted users only until the plugin is updated
  • Implement server-side input filtering to strip potentially malicious content from shortcode attributes
  • Deploy a WAF rule to sanitize or block requests containing XSS patterns in shortcode parameters
  • Use WordPress capability management plugins to temporarily revoke shortcode usage permissions from non-administrative users
bash
# WP-CLI commands to update the OSM plugin
wp plugin update osm --path=/var/www/html/wordpress

# Search for potentially malicious content in existing posts
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[osm_map_v3%' AND (post_content LIKE '%<script%' OR post_content LIKE '%javascript:%' OR post_content LIKE '%onerror%' OR post_content LIKE '%onload%')" --path=/var/www/html/wordpress

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

  • Vulnerability Details
  • TypeXSS

  • Vendor/TechWordpress

  • SeverityMEDIUM

  • CVSS Score6.4

  • EPSS Probability0.06%

  • Known ExploitedNo
  • CVSS Vector
  • CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • Impact Assessment
  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityNone
  • CWE References
  • CWE-79
  • Technical References
  • WordPress OSM Icon Class Line 347

  • WordPress OSM Icon Class Line 356

  • WordPress OSM Map V3 Line 31

  • WordPress OSM Map V3 Line 560

  • WordPress OSM Icon Class Trunk Line 347

  • WordPress OSM Icon Class Trunk Line 356

  • WordPress OSM Map V3 Trunk Line 31

  • WordPress OSM Map V3 Trunk Line 560

  • WordPress OSM Changeset Report

  • Wordfence Vulnerability Analysis
  • Related CVEs
  • CVE-2026-4512: reCaptcha by WebDesignBy XSS Vulnerability

  • CVE-2025-32630: WP-BusinessDirectory XSS Vulnerability

  • CVE-2025-32581: WordPress Spam Blocker XSS Vulnerability

  • CVE-2025-28975: Alike WordPress Plugin XSS Vulnerability
Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the World’s Most Advanced Cybersecurity Platform

See how our intelligent, autonomous cybersecurity platform can protect your organization now and into the future.

Try SentinelOne
  • Get Started
  • Get a Demo
  • Product Tour
  • Why SentinelOne
  • Pricing & Packaging
  • FAQ
  • Contact
  • Contact Us
  • Customer Support
  • SentinelOne Status
  • Language
  • Platform
  • Singularity Platform
  • Singularity Endpoint
  • Singularity Cloud
  • Singularity AI-SIEM
  • Singularity Identity
  • Singularity Marketplace
  • Purple AI
  • Services
  • Wayfinder TDR
  • SentinelOne GO
  • Technical Account Management
  • Support Services
  • Verticals
  • Energy
  • Federal Government
  • Finance
  • Healthcare
  • Higher Education
  • K-12 Education
  • Manufacturing
  • Retail
  • State and Local Government
  • Cybersecurity for SMB
  • Resources
  • Blog
  • Labs
  • Case Studies
  • Videos
  • Product Tours
  • Events
  • Cybersecurity 101
  • eBooks
  • Webinars
  • Whitepapers
  • Press
  • News
  • Ransomware Anthology
  • Company
  • About Us
  • Our Customers
  • Careers
  • Partners
  • Legal & Compliance
  • Security & Compliance
  • Investor Relations
  • S Foundation
  • S Ventures

©2026 SentinelOne, All Rights Reserved.

Privacy Notice Terms of Use

English