CVE-2026-15755 describes a stored cross-site scripting vulnerability in the Open User Map – Interactive Leaflet Maps plugin for WordPress. The flaw exists in shortcode attribute handling, allowing authenticated contributors or higher to inject arbitrary scripts. These scripts execute when an administrator previews the post, even if the post is pending review and not published. The vulnerability is due to improper neutralization of input during web page generation (CWE-79). It affects all plugin versions up to and including 1.4.45. No vendor advisory or patch information is available at this time.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the context of administrators or other users who preview the affected posts, potentially leading to credential theft, session hijacking, or other malicious actions limited to the privileges of the victim user. The vulnerability does not affect unauthenticated users directly and requires at least contributor privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and avoid previewing posts from untrusted contributors. Monitor official 100plugins communications for updates or patches addressing this vulnerability.