The MiKa OpenStreetMap WordPress plugin before version 6.1.15 contains a cross-site scripting vulnerability that allows a logged-in user with page editing privileges to embed malicious scripts through crafted HTTP requests. This script executes in the browsers of users who view the affected pages, potentially compromising confidentiality and integrity. The vulnerability has a CVSS 3.0 base score of 5.4 (medium severity) with network attack vector, low attack complexity, required privileges, and user interaction. No official patch or remediation information is available from the vendor at this time.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users' browsers, potentially resulting in information disclosure or manipulation of user sessions. The vulnerability requires a logged-in user with page editing rights to inject the script and user interaction to trigger execution. There is no indication of impact to availability. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict page creation and editing privileges to trusted users only and consider monitoring for suspicious activity related to page content. Avoid visiting or sharing pages created or edited by untrusted users.