Description

Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-08T08:17:13.523Z",
  "pubdate": "2026-09-08T08:17:13.523Z",
  "executiveSummary": "Open User Map versions 1.4.50 and below contain a critical Unauthenticated Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript code within the context of a victim's browser session.\nThe flaw stems from improper neutralization of user-supplied input before it is rendered on the client-side.\nThe impact includes the potential for session hijacking, unauthorized actions on behalf of the user, sensitive data exfiltration, and the redirection of users to malicious third-party domains.\nBecause the vulnerability is unauthenticated, exploitation does not require prior knowledge of legitimate user accounts or administrative privileges.\nThe risk profile is significant as it affects the fundamental security of the interaction between the application and its users, potentially compromising user integrity and confidentiality.\nOrganizations utilizing Open User Map in the affected version range are urged to treat this as a priority, as public proof-of-concept exploits may increase the risk of widespread automated scanning and exploitation.",
  "technicalDetails": "The vulnerability is classified as a Stored or Reflected Cross-Site Scripting (XSS) flaw, contingent on the specific implementation of user input handling within the Open User Map plugin architecture.\nThe root cause is the failure of the plugin to implement robust input sanitization or output encoding mechanisms for data passed through URI parameters or submitted via frontend forms.\nWhen the application renders user-supplied data, it fails to encode characters such as <, >, \", and ' before echoing them to the Document Object Model (DOM).\nAn unauthenticated attacker can craft a malicious URL containing a JavaScript payload or submit a payload through a public-facing map input field. When the victim interacts with the link or views the map containing the malicious entry, the payload is parsed by the browser as executable code rather than plain text.\nThe attack flow proceeds as follows: First, the attacker identifies a vulnerable parameter or input field processed by the plugin. Second, the attacker encodes a malicious JavaScript payload (e.g., <script>alert(document.cookie)</script>) into the target vector. Third, the victim navigates to the crafted URL or triggers a page update that loads the injected content. Finally, the victim's browser executes the script within the origin of the vulnerable site, granting the attacker access to session cookies, localStorage data, or the ability to modify the page content via DOM manipulation.\nThe vulnerability is classified as unauthenticated because no session token or valid account authentication is required to submit the malicious input or trigger the malicious response. It operates entirely over the network, making any web server hosting the plugin a potential vector.\nPost-exploitation impact includes full account takeover if the attacker successfully captures session identifiers, or persistent defacement of the user map if the payload is stored server-side. Additionally, the attacker can leverage the victim's browser to initiate further attacks against the local area network or conduct credential harvesting campaigns using deceptive overlays.\nThe failure to apply Context-Aware Output Encoding (CAOE) or utilize secure web development frameworks that automatically neutralize untrusted input is the primary technical deficiency identified in the plugin's codebase."
}