PT-2026-48610 · WordPress · Open User Map Pro

Hunter Jensen · CVE-2026-2827 · Published 2026-06-11 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open User Map PRO versions prior to 1.4.32

Description The Open User Map PRO plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because of insufficient input sanitization and output escaping involving the oum location notification parameter. Unauthenticated attackers can exploit this to inject arbitrary web scripts into pages, which then execute when a user accesses the affected page.

Recommendations Update to a version later than 1.4.31. As a temporary workaround, restrict or disable the use of the oum location notification parameter to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2827

Affected Products

Open User Map Pro

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2827 · Security Note
• https://t.me/cveNotify/167059 · Telegram Post
• https://t.me/cveNotify/166984 · Telegram Post
• https://open-user-map.com · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9963e0f8-600c-4b1f-935d-4ac1f967698f?source=cve · Note
• https://t.me/CVEtracker/56533 · Telegram Post