Vulnerability · Published Mar 27, 2026 · Assigned by jpcert

CVE-2026-33559

Medium 5.4

In plain English

A medium-severity cross-site scripting in OpenStreetMap from MiKa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.0)5.4Medium

Exploit odds (30 days)0.2%top 93.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a logged-in user with a page-creating/editing privilege can embed some malicious script with a crafted HTTP request. When a victim user accesses this page, the script may be executed in the user's web browser.

Affected products (as reported)

Vendor	Product	Versions
MiKa	OpenStreetMap	prior to 6.1.15

Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References