CVE-2026-4429: OSM OpenStreetMap WordPress XSS Flaw

CVE-2026-4429 Overview

The OSM – OpenStreetMap plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the [osm_map_v3] shortcode. Specifically, the marker_name and file_color_list shortcode attributes fail to properly sanitize user input and escape output, allowing authenticated attackers with Contributor-level access or above to inject malicious JavaScript code. When an unsuspecting user visits a page containing the injected payload, the malicious scripts execute in their browser context.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in visitors' browsers, potentially leading to session hijacking, credential theft, or malware distribution across WordPress sites using this plugin.

Affected Products

• OSM – OpenStreetMap plugin for WordPress versions up to and including 6.1.15
• WordPress sites with Contributor-level or higher user access enabled
• Any WordPress installation utilizing the [osm_map_v3] shortcode functionality

Discovery Timeline

• April 9, 2026 - CVE-2026-4429 published to NVD
• April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4429

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The issue arises because the OSM plugin fails to implement proper input validation and output encoding for shortcode attributes processed within the [osm_map_v3] shortcode handler.

The vulnerable code paths can be traced to multiple locations in the plugin codebase, including osm-icon-class.php at lines 347 and 356, as well as osm-sc-osm_map_v3.php at lines 31 and 560. The attack vector is network-based and requires authentication at a low privilege level (Contributor), but once the malicious content is stored, no further user interaction is required for the script to execute.

Root Cause

The root cause of this vulnerability is insufficient input sanitization and output escaping in the shortcode processing logic. When the marker_name and file_color_list attributes are processed by the plugin, user-supplied values are rendered directly into the page HTML without proper encoding. WordPress provides functions such as esc_attr(), esc_html(), and wp_kses() specifically to prevent XSS attacks, but these safeguards were not implemented for the affected shortcode attributes.

Attack Vector

An attacker with Contributor-level access or higher can craft a malicious shortcode containing JavaScript payloads within the marker_name or file_color_list attributes. When this shortcode is embedded in a post or page and published (or submitted for review), the malicious script becomes persistently stored in the WordPress database. Subsequently, any user who views the page—including administrators—will have the malicious JavaScript execute in their browser context.

The attack enables various malicious activities including session cookie theft, keylogging, phishing overlay injection, drive-by download initiation, and administrative action execution on behalf of privileged users. For detailed technical analysis, refer to the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-4429

Indicators of Compromise

• Unexpected JavaScript code or <script> tags appearing within [osm_map_v3] shortcode attributes in posts, pages, or custom post types
• Browser developer console errors or suspicious network requests originating from map-embedded pages
• Anomalous outbound connections to unknown domains when users view pages containing OpenStreetMap embeds
• Reports of unexpected browser behavior or pop-ups from users viewing WordPress content with OSM maps

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS patterns in shortcode parameters
• Conduct regular database audits scanning the wp_posts table for suspicious patterns within [osm_map_v3] shortcode content
• Enable Content Security Policy (CSP) headers to restrict script execution sources and receive violation reports
• Deploy SentinelOne Singularity XDR to monitor for behavioral anomalies associated with XSS exploitation

Monitoring Recommendations

• Configure WordPress audit logging to track all shortcode usage and post modifications by Contributor-level users
• Monitor server access logs for unusual patterns in requests to pages containing OSM map embeds
• Implement real-time alerting for CSP violation reports indicating inline script execution attempts
• Review user activity logs for bulk content creation or modification patterns that may indicate exploitation attempts

How to Mitigate CVE-2026-4429

Immediate Actions Required

• Update the OSM – OpenStreetMap plugin to the latest patched version immediately
• Audit all existing posts and pages for potentially malicious content in [osm_map_v3] shortcode attributes
• Review user accounts with Contributor-level access and above for any unauthorized or suspicious activity
• Consider temporarily disabling the OSM plugin until the update can be applied if immediate patching is not possible

Patch Information

A security patch addressing this vulnerability has been released. The fix implements proper input sanitization and output escaping for the marker_name and file_color_list shortcode attributes. The changeset details are available in the WordPress plugin repository. Site administrators should update to the latest version through the WordPress admin dashboard or via WP-CLI.

Workarounds

• Restrict Contributor-level access to trusted users only until the plugin is updated
• Implement server-side input filtering to strip potentially malicious content from shortcode attributes
• Deploy a WAF rule to sanitize or block requests containing XSS patterns in shortcode parameters
• Use WordPress capability management plugins to temporarily revoke shortcode usage permissions from non-administrative users

# WP-CLI commands to update the OSM plugin
wp plugin update osm --path=/var/www/html/wordpress

# Search for potentially malicious content in existing posts
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[osm_map_v3%' AND (post_content LIKE '%<script%' OR post_content LIKE '%javascript:%' OR post_content LIKE '%onerror%' OR post_content LIKE '%onload%')" --path=/var/www/html/wordpress