Open User Map

Open User Map through 1.4.46 lets a Contributor supply attacker-controlled input that reaches a browser-executable output context without adequate neutralization. The payload can execute in the site's origin when another user views the crafted output. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, field, parameter or rendering function.

Open User Map through 1.4.45 lets a Contributor store attacker-controlled lat, long and zoom attributes in an [open-user-map] shortcode, including in a post submitted only for review. render_block_map() passes those attributes through partial-map-init.php without enforcing numeric coordinate values, and partial-map-render.php inserts them into JavaScript map variables. The stored script executes when an administrator previews the pending post or another visitor opens the rendered page.

Open User Map is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Open User Map is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Open User Map is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.