100plugins vulnerabilities

Products

• Open User Map 5
• Open User Map – Interactive Leaflet Maps 1
• Open User Map PRO 1

Latest 100plugins CVEs

Newest publication first

1. CVE-2026-84818 WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-08

   High·CVSS 7.1

   Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.

2. CVE-2026-66445 WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability

   Published 2026-07-27

   Medium·CVSS 6.5

   Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.

3. CVE-2026-15755 Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

   Published 2026-07-24

   Medium·CVSS 6.4

   The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

4. CVE-2026-2827 Open User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'

   Published 2026-06-11

   Medium·CVSS 4.7

   The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notification' parameter in versions up to, and including, 1.4.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated at...

5. CVE-2025-68002 WordPress Open User Map plugin <= 1.4.16 - Arbitrary File Download vulnerability

   Published 2026-02-20

   Medium·CVSS 6.5

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 100plugins Open User Map open-user-map allows Path Traversal.This issue affects Open User Map: from n/a through <= 1.4.16.

6. CVE-2025-57953 WordPress Open User Map Plugin <= 1.4.14 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-09-22

   Medium·CVSS 6.5

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 100plugins Open User Map open-user-map allows DOM-Based XSS.This issue affects Open User Map: from n/a through <= 1.4.14.

7. CVE-2023-45056 WordPress Open User Map | Everybody can add locations Plugin <= 1.3.26 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-10-18

   Medium·CVSS 5.9

   Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.