CVE-2026-2827 is a stored cross-site scripting vulnerability in the Open User Map PRO plugin for WordPress. It arises from improper neutralization of input during web page generation, specifically via the 'oum_location_notification' parameter. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The vulnerability affects versions up to and including 1.4.31. No official patch or remediation level has been provided in the available data.

Successful exploitation can lead to the execution of arbitrary scripts in users' browsers, potentially resulting in information disclosure or session hijacking. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable parameter if possible and monitor for updates from the vendor. No official remediation or temporary fix is currently documented.