OSM – OpenStreetMap

OSM – OpenStreetMap has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 10 are fixed as of October 2026. Their average CVSS score is 6.8, and the most serious one scores 9.9 out of 10. Severity breakdown: 1 critical and 1 high. 2024 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 7 of the records (70%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.

Every one of the 10 issues recorded for OSM – OpenStreetMap has a vendor fix available, so running the current release closes all known holes.

9 independent researchers contributed these findings, most of them (2) reported by Krzysztof Zając. OSM – OpenStreetMap is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.

Strategic Overview

Avg CVSSMedium
6.8/ 10
Patch Coverage100%
Open

0

Fixed

10

Get automatic notifications for all OSM – OpenStreetMap vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.9CVE-2024-3604

OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) SQL Injection

Read the full analysis

Vulnerability Records

10 records
2026-04-08 00:00CVE-2026-4429
6.4
Medium
Nguyen Ngoc Duc (duc193)Yes
2026-03-27 00:00CVE-2026-33559
6.4
Medium
Naoya Takahashi (nakko)Yes
2026-01-29 00:00CVE-2026-25323
4.3
Medium
Nabil IrawanYes
2025-03-31 00:00CVE-2025-31557
6.4
Medium
Muhammad Yudha - DJYes
2024-11-08 00:00CVE-2024-52355
6.4
Medium
Junwoo KangYes
2024-09-26 18:40CVE-2024-8991
6.4
Medium
Peter ThaleikisYes
2024-07-08 20:10CVE-2024-3604
9.9
Critical
Krzysztof ZającYes
2024-07-08 20:10CVE-2024-3603
6.4
Medium
Krzysztof ZającYes
2023-05-03 00:00CVE-2022-4676
6.4
Medium
István MártonYes
2022-09-30 00:00CVE-2022-30544
8.8
High
Rasi AfeefYes
Showing 1–10 of 10 reports
OSM – OpenStreetMap banner
Latestv6.2.6

OSM – OpenStreetMap

MiKa

Author

MiKa

4.6(137)
92/100
Last Updated
2026-06-04 (5mo ago)
Active Installs
10,000+
Downloads
707,193
Requires WP
5.0+
Requires PHP
5.3+
Tested up to
WP 7.0.7
Created
2009-04-08 (18y ago)

Add a map with a marker in less than 100 seconds:Add a map with marker in less than 100 sec: If you want detailed information about the OSM plugin, visit these pages: Homepage: WP-OSM-Plugin Forum: EN|DE Bluesky: @mika-official.bsky.social Features of the WP OSM plugin: OpenStreetMap, HOT, OpenSeaMap, OpenTopoMap, BaseMap (AT), Stamen in posts/pages Integration in post / page / widget HTML Popup Marker GPX and KML (including upload in the Media Library) Map with geo-tagged posts/pages as linked marker Map with autogenerated track by geo-tagged posts / pages HTML meta tags for geo-tagged posts/pages Uses the OpenLayers library SSL connection (HTTPS) Languages – thanks to: English Deutsch Japanese [by Sykane] French [by Tounoki and Marc] Russian [by Вячеслав Стренадко/Vyacheslav Strenadko] Italian [by Andrea Giacomelli] Spanish [by Colegota] Romanian [by Sorin Pop] Swedish [by Olle Zettergren] OpenLayers: Open Source JavaScript, released under the 2-clause BSD IMPORTANT: The WordPress Plugin Review Team requires an opt-in feature for attribution display according to the WordPress Plugin Guidelines. Please enable the checkbox “Display attribution (credit) in the map.” in the WP OSM plugin shortcode generator, or add attribution manually to your map. Otherwise, this may violate map or data licenses, for example OpenStreetMap. This plugin enables GPX and KML upload! Licenses of the maps: * OpenStreetMap: OpenStreetMap License * OpenTopoMap: OpenTopoMap License * Stamen Maps: Stamen License * BaseMap: BaseMap License * Thunderforest (API key): Thunderforest License * Others: Depends on the map you are including – check it before including it!

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C