Leaflet Map Extensions CVE-2026-103485

Exploitation is gated by a specific, non-default deployment: a site administrator must have previously published a PUBLIC map using the combined [leaflet-map]+[leaflet-geojson]+[choropleth] shortcodes, and that choropleth map's GeoJSON src URL must resolve to a feed the attacker can control or influence - achieved through compromise of the external data host, a subdomain takeover of that host, or a site intentionally configured to consume an attacker-hosted feed. The concrete sink is the 'feature.properties[<template-token>]' value, which is rendered to the DOM without sufficient input sanitization or output escaping. Limiting factors: the attacker cannot inject without already controlling the upstream GeoJSON source, the map must be public, and the exact choropleth shortcode stack must be in use - maps not using attacker-influenceable external GeoJSON feeds are not exploitable. Although the attacker needs no WordPress authentication (PR:N), these configuration and data-source-control prerequisites account for the AC:H rating.

This is a moderate-severity, highly conditional stored DOM-based XSS rather than a broadly exploitable flaw. The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, base 5.4) encodes the key tension: although PR:N marks the attacker as unauthenticated, AC:H reflects substantial preconditions, and the description confirms why - exploitation requires that a site administrator has already published a public map built from the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination AND that the map's GeoJSON src URL points at a feed the attacker controls (via compromise of the external data host, subdomain takeover, or a site deliberately pointing at an attacker feed). The attacker does not inject directly into WordPress; they poison the upstream data source. No CISA KEV listing and no EPSS score are provided, and there is no confirmed working exploit - the references are the Wordfence advisory and trac source-code lines, not a weaponized PoC. The vuln.today priority is 'this_month' (not act_now/emergency), consistent with a real but non-urgent, prerequisite-heavy issue. Net: low-to-moderate real-world risk dominated by whether any site actually runs the specific choropleth configuration against an attacker-influenceable feed, not a mass-exploitable web vulnerability.

An administrator has published a public choropleth map whose GeoJSON data is pulled from an external URL. An attacker who gains control of that data source (e.g., via subdomain takeover or compromise of the external host) injects malicious script into a feature's properties, which the plugin writes into the page DOM without sanitization. Any visitor who loads the map page then executes the attacker's script in their browser. No confirmed working exploit code is identified at time of analysis.