100plugins Open User Map vulnerabilities

Latest 100plugins Open User Map CVEs

Newest publication first

1. CVE-2026-84818 WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-08

   High·CVSS 7.1

   Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.

2. CVE-2026-66445 WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability

   Published 2026-07-27

   Medium·CVSS 6.5

   Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.

3. CVE-2024-13362 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

   Published 2026-05-01

   Medium·CVSS 6.1

   Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

4. CVE-2025-68002 WordPress Open User Map plugin <= 1.4.16 - Arbitrary File Download vulnerability

   Published 2026-02-20

   Medium·CVSS 6.5

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 100plugins Open User Map open-user-map allows Path Traversal.This issue affects Open User Map: from n/a through <= 1.4.16.

5. CVE-2025-57953 WordPress Open User Map Plugin <= 1.4.14 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-09-22

   Medium·CVSS 6.5

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 100plugins Open User Map open-user-map allows DOM-Based XSS.This issue affects Open User Map: from n/a through <= 1.4.14.

6. CVE-2024-32594 WordPress Attesa Extra plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerability

   Published 2024-04-18

   Medium·CVSS 6.5

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AttesaWP Attesa Extra allows Stored XSS.This issue affects Attesa Extra: from n/a through 1.3.9.

7. CVE-2023-45056 WordPress Open User Map | Everybody can add locations Plugin <= 1.3.26 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-10-18

   Medium·CVSS 4.8

   Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.