CVE-2026-66445 100plugins CVE debrief

Who should care

Users of Open User Map plugin version 1.4.46 and earlier should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes updating the plugin to a version that is not vulnerable, implementing input validation and output encoding, and monitoring plugin usage and user activity for suspicious behavior. Additionally, operators, platform administrators, vulnerability management teams, and security teams may need to review and update their security controls to address this vulnerability.

Technical summary

The Open User Map plugin is vulnerable to Cross Site Scripting (XSS) attacks. An attacker with contributor-level privileges could inject malicious scripts into the plugin, potentially leading to security issues. The vulnerability has a CVSS score of 6.5 and a severity rating of MEDIUM. The plugin is used to display user information on a map, and the vulnerability could be exploited to steal user data or take control of the plugin.

Defensive priority

Medium priority

Recommended defensive actions

• Update Open User Map plugin to a version that is not vulnerable
• Implement input validation and output encoding to prevent XSS attacks
• Monitor plugin usage and user activity for suspicious behavior
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-27T15:17:11.573Z and has not been modified since then. The NVD entry is currently Deferred. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The Open User Map plugin version 1.4.46 and earlier are reportedly vulnerable to Cross Site Scripting (XSS) attacks.

Official resources